Threat database

A Cross-Site Scripting (XSS) vulnerability exists in Broadcom Symantec Endpoint Detection and Response (SEDR) Console versions 4.12 and prior to 4.13. This vulnerability allows an attacker to inject malicious scripts that execute in the context of another user's session, potentially leading to unauthorized access to restricted functionality or information.

CVE-2026-63168 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can exploit this flaw by submitting malicious script code via two-dimensional POST arrays during the LDAP/person import process. The vulnerability arises because the paramsFilter() function does not properly recurse into nested arrays, allowing unneutralized markup to be persisted in user profiles. This malicious script can then execute in other users' browsers when the profile is viewed.

CVE-2026-63157 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated users can inject malicious scripts via an unsanitized 'adress' field in the Links module, which is reflected in an onclick event-handler attribute without proper neutralization of quotes. This vulnerability allows execution of arbitrary scripts in the browsers of users viewing the links list, potentially leading to session hijacking or client-side compromise.

Omnispace Agora Project versions before 26.10.0 have a reflected cross-site scripting (XSS) vulnerability in the visioUrl parameter. This flaw allows unauthenticated attackers to inject malicious HTML attributes and execute arbitrary JavaScript in victims' browsers before authentication. The vulnerability arises because the visioUrl parameter bypasses URL sanitization and is urldecoded after filtering. The issue is fixed in version 26.10.0.

CVE-2026-63148 is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can exploit this by uploading a poll-response attachment with a malicious filename that bypasses input sanitization. The malicious filename is stored and later rendered in user-facing components like the dashboard, enabling script execution in the browsers of users who view the affected page.

Adobe Substance 3D Stager contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires user interaction by opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS score is 5.5, indicating medium severity.

Adobe Substance 3D Stager contains an out-of-bounds write vulnerability (CWE-787) that can lead to arbitrary code execution with high impact on confidentiality, integrity, and availability. Exploitation requires user interaction by opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. No patch information is provided, and no known exploits are reported in the wild.

Adobe Substance 3D Stager contains an out-of-bounds read vulnerability (CWE-125) when parsing specially crafted files. This flaw could allow an attacker to read memory beyond allocated bounds, potentially leading to code execution under the current user's privileges. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS score is 7.8, indicating high severity.

Adobe Substance 3D Stager contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS score is 7.8, indicating high severity.

Adobe Substance 3D Stager contains an out-of-bounds write vulnerability (CWE-787) that can lead to arbitrary code execution with high impact on confidentiality, integrity, and availability. Exploitation requires user interaction by opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS 3.1 base score is 7.8, indicating high severity.

Adobe Substance 3D Stager contains an out-of-bounds write vulnerability (CWE-787) that can lead to arbitrary code execution with high impact on confidentiality, integrity, and availability. Exploitation requires user interaction by opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. No patch information is provided, and no known exploits are reported in the wild.

Adobe Substance 3D Stager contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The issue has a high severity rating with a CVSS score of 7.8.

Adobe Substance 3D Stager contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS 3.1 base score is 7.8, indicating a high severity issue.

Adobe Substance 3D Stager contains an out-of-bounds read vulnerability (CWE-125) when parsing specially crafted files. This flaw can cause the application to read beyond allocated memory, potentially allowing an attacker to execute code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS 3.1 base score is 7.8, indicating high severity.

Adobe Substance 3D Stager contains an out-of-bounds write vulnerability (CWE-787) that can lead to arbitrary code execution with high impact on confidentiality, integrity, and availability. Exploitation requires user interaction by opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS score is 7.8, indicating a high severity level.

Adobe Substance 3D Stager contains an out-of-bounds read vulnerability (CWE-125) that may allow an attacker to disclose sensitive memory contents. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS score is 5.5 (medium severity), indicating a moderate risk primarily impacting confidentiality without affecting integrity or availability.

Adobe Substance 3D Stager contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS 3.1 base score is 7.8, indicating a high severity issue.

Adobe Substance 3D Stager contains a stack-based buffer overflow vulnerability that can lead to arbitrary code execution when a user opens a specially crafted malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. Exploitation requires user interaction. The vulnerability has a high severity rating with a CVSS score of 7.8.

Adobe Substance 3D Stager contains an out-of-bounds read vulnerability (CWE-125) when parsing specially crafted files. This flaw can lead to reading beyond allocated memory, potentially allowing an attacker to execute code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS 3.1 base score is 7.8, indicating high severity.

Adobe Substance 3D Stager contains a stack-based buffer overflow vulnerability that can lead to arbitrary code execution when a user opens a specially crafted malicious file. This vulnerability affects versions from 0 up to and including 3.1.8. Exploitation requires user interaction. The vulnerability has a high severity rating with a CVSS score of 7.8.