| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Runtime Professional V20 (All versions), SIMATIC WinCC Runtime Professional V21 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected systems do not properly secure their remote user authentication with the deprecated NTLM protocol. This could allow unauthenticated remote attackers, who have achieved a machine in the middle position, to relay NTLM authentication and impersonate a legitimate user. The potential impact depends on the services that are accessible, e.g. a SQL server used by WinCC. |
| In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.
This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.
Users are recommended to upgrade to version 3.9.1 which fixes this issue. |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improper authorization. Information supplied by the client is relied on when deciding what a user is allowed to do, which could allow unauthorized changes that disrupt service. |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization. |
| apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m_compressedCache via an oversized compressed chunk length. Attackers can supply a crafted .trace file whose 4-byte chunk length exceeds the fixed buffer size, corrupting heap memory when users dump, inspect, or replay it. |
| Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root. |
| Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it. |
| Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by create_user and modify_user to backquote_logged, executing commands as root. |
| Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase m_blocks_per_mcu without checking the buffers sized from the frame components. A crafted grayscale JPEG can repeat its component in the SOS header, causing decode paths in src/loaders/jpg/tvgJpgd.cpp to write beyond heap buffers sized for one component. The issue is reachable through direct JPEG decoding and through JPEG images embedded in Lottie content, and confirmed impact is memory corruption followed by a process crash. This issue is fixed in version 1.1.2. |
| In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session |
| In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker |
| In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports |
