| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbitrary code via the id_service.exe component |
| An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506. |
| An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module. |
| A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities. |
| The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result in a total loss of confidentiality. |
| An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability. |
| An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability. |
| A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability. |
| A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability. |
| In all released versions of MIT krb5, an unauthenticated attacker can cause a KDC process to perform a large read overrun, likely causing the process to terminate. |
| A missing integrity verification vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged authenticated attacker to gain elevated privileges on the affected system. |
| Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low) |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data. |
| This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction. |
| This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen. |
| An
API key is hardcoded and retrievable from the GV-Face package. Since
Android applications can be reverse engineered, embedding sensitive API
credentials directly in the client application may allow unauthorized users to
extract and misuse the key. |
| The RSA cryptographic key material, including a private key and public key, is
embedded within the application package. Because Android applications can
be extracted and reverse engineered, storing private cryptographic keys
directly inside the client application may allow an attacker to recover the
keys and potentially use them to impersonate the application, decrypt protected
data, or generate unauthorized cryptographic operations. |
| GV-Face transmits sensitive user credentials and
related authentication data over unencrypted HTTP connections. The HTTP
traffic is not encrypted, an attacker with the ability to intercept network
traffic. |
| The RSA cryptographic key
material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and
reverse engineered, storing private cryptographic keys directly inside the
client application may allow an attacker to recover the keys and potentially
use them to impersonate the application, decrypt protected data, or generate
unauthorized cryptographic operations. |
