| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a bug report but has not responded yet. |
| LimeSurvey fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface. |
| BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images. |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint (`CommandsResource.java:31`). A local actor can invoke unauthenticated commands to cause resource exhaustionand halt business-rule management functions. |
| The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of the intended query logic. |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An unauthenticated attacker can craft a request with a manipulated `Host` header to redirect authenticated operators to attacker-controlled sites, enabling credential phishing. |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection. |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS.
This issue affects JetTricks: from n/a through 2.0.1. |
| Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks. |
| Editor SQL Injection in Ultimeter <= 3.0.8 versions. |
| Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions. |
| Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions. |
| Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 versions. |
| Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
| Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions. |
| Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions. |
| Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions. |
| Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. |
| Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions. |
