CVE Database

An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authenticated attacker to trigger a denial of service.

Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in …

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can …

The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated …

The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible …

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke …

When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. …

When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not …

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can …

The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach …

The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with …

In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. …

The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to …

The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files …

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being …

Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM …

Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the …

Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers …

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a …

postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote …

Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to …

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other …

ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside …

Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores …

Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with …

Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET …

TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary …

Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. …

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong …

An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account …

An information exposure flaw in the public access-list sign-up feature of the Flock Safety Platform, present from 2026-06-23 to 2026-10-22, allowed a remote, unauthenticated attacker …

Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, prior to 2026-09-28, allowed an authenticated user with permission to …

A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories …

An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a local authenticated attacker …

Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.

A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially crafted .wav file can lead to an out-of-bounds write. …

A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3). A specially crafted .mp3 file can lead to an out-of-bounds read. …

In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider) do not check identity and permission …

The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by …

The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker …

The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict …

The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web …

With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. …

When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the …

The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin …

The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this …

The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page …

The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the …

When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned …