Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. Successful exploitation of this vulnerability may affect some wireless projection features.

Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.

An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via the log files.

Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows a remote authenticated attacker to execute arbitrary code via a crafted malicious script.

Farsight Tech Nordic AB ProVide

Farsight Tech Nordic AB ProVide version 14.5 - Multiple XSS vulnerabilities (CWE-79) can be exploited by a user with administrator privilege.

7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Synel Terminals - CWE-494: Download of Code Without Integrity Check

Synel Terminals - CWE-494: Download of Code Without Integrity Check

Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File

Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File

Tadiran Telecom Aeonix - CWE-22: Improper Limitation of a Pathname to a Restricted Directory

Tadiran Telecom Aeonix - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy

Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy

AnaSystem SensMini M4 – an authenticated user can cause Denial of Service

AnaSystem SensMini M4 – Using the configuration tool, an authenticated user can cause Denial of Service for the device

JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials

JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials

Heights Telecom ERO1xS-Pro Dual-Band WiFi command injection

Heights Telecom ERO1xS-Pro Dual-Band FW version BZ_ERO1XP.025.

Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection'

Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection'

Mozilla: Lack of warning when opening Diagcab files

When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause loss of confidentiality when replacing a project file on the local filesystem and after manual restart of the server.

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored.

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages.

A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the mass configuration settings of endpoints on DCE.

A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the alert settings of endpoints on DCE.