Płatnik has a vulnerability where it performs client-side authentication, allowing an attacker with access to any connected application instance to bypass login verification and authenticate as any user. This security flaw was fixed in version 10.02.002 (metric 242).
Płatnik software used a weak password encoding algorithm that allowed users who obtained encoded passwords to easily decode them. This vulnerability was fixed in version 10.02.002 (metric 242). The issue has a high severity rating with a CVSS score of 7.7.
ProFTPD versions before 1.3.9e and 1.3.10rc5 have a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap. This flaw allows remote attackers to send FTP command arguments longer than 1024 bytes, potentially overwriting static buffers and corrupting session memory, which can crash the session. The vulnerability can be exploited without authentication if pre-login commands are rewritten.
SQLite versions before 3.54.0 have a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit. This occurs because common table expressions (CTEs) are not counted against this limit. An attacker can supply a WITH clause chaining tens of thousands of CTEs, either via plain SQL or a view in an untrusted database file, causing unbounded recursion in selectExpander() that crashes the process.
SQLite versions before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contain a use-after-free vulnerability in the fts3BestSnippet() function. This flaw is triggered by dangling cached position-list pointers when running a full-text MATCH query that combines OR and NEAR operators with snippet(). Exploitation can lead to reading freed heap memory and crashing the process.
SQLite versions before 3.54.0 built with the FTS5 extension contain a heap buffer overflow vulnerability in the fts5MergeRowidLists() function. This flaw occurs because the function undersizes the output buffer when merging detail=none prefix doclists. An attacker able to insert negative rowids into a detail=none FTS5 table and execute a prefix MATCH query can trigger a heap overflow, leading to memory corruption and potential process crashes.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability involving improper neutralization of argument delimiters, classified as an Argument Injection flaw. This vulnerability allows a high privileged attacker with remote access to potentially elevate their privileges within the system. The flaw is identified as CWE-88 and carries a high severity with a CVSS score of 7.2.
SQLite versions before 3.54.0 built with the FTS5 extension contain a heap buffer overflow vulnerability in the fts5DoSecureDelete() function. This flaw allows attackers to write beyond the allocated leaf page buffer by supplying a crafted database file with a corrupted FTS5 index. When secure-delete is enabled and the corrupted index is deleted, heap memory corruption and application crashes can occur.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an OS command injection vulnerability due to improper neutralization of special elements. This flaw allows a low-privileged remote attacker to execute arbitrary commands on the affected system without user interaction. The vulnerability has a high severity rating with a CVSS score of 8.8.
ProFTPD versions through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 have a vulnerability in the mod_copy module that allows authenticated FTP users to bypass write restrictions by exploiting symbolic links. This enables attackers to overwrite files in locations where write access is normally denied by placing symlinks in writable directories and using SITE COPY or SITE CPTO commands.
SQLite versions before 3.54.0 have an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory. This occurs when an attacker supplies a Write-Ahead Logging (WAL) file with an undersized page size, causing queries such as substr() to return stale bytes. These stale bytes can disclose data from other table rows and internal pointers.
Płatnik software uses the HTTP protocol to download updates, libraries, and support files, which exposes it to Man-In-The-Middle (MITM) attacks. An attacker could intercept and modify these files during transmission. This vulnerability was fixed in version 10.02.002 (metric 242).
ProFTPD versions before 1.3.9e and 1.3.10rc5 have an authorization bypass vulnerability in the mod_sftp copy-file extension handler. This flaw allows authenticated SFTP users to bypass Limit WRITE checks when copying files, enabling them to create new files in directories where uploads are normally forbidden.
CVE-2026-105924 is a NULL pointer dereference vulnerability in the Qt Core module affecting the QCborValue to JSON conversion functionality. This flaw can cause application crashes or denial of service when processing certain inputs. The vulnerability has a medium severity rating with a CVSS score of 6.8. No affected versions or patch information are provided in the available data.
A vulnerability in ARKETEAM Protectel modules PROTECTELMAJ and BDF allows low privileged users to access some functionalities reserved for admin users by forging direct requests to a specific endpoint. This issue has been fixed in PROTECTELMAJ version 6.5.19 and BDF version 6.4.67.
A Cross-Site Scripting (XSS) vulnerability exists in the auth/handler component of Google Cloud Identity Platform and Firebase Authentication on iOS versions prior to 2026-08-14. This flaw allows an unauthenticated remote attacker to execute arbitrary JavaScript by leveraging a malicious iOS bundle ID. The vulnerability has a high severity rating with a CVSS score of 8.7.
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored Cross-Site Scripting (XSS). This vulnerability allows a low privileged attacker to inject arbitrary HTML and JavaScript into notes, which execute when viewed by users. The issue has been fixed in PROTECTELMAJ version 6.5.19 and BDF version 6.4.67.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a high-privileged attacker with remote access to potentially cause information exposure. The vulnerability has a low CVSS score of 2.7, indicating limited impact. No public exploits or known active exploitation have been reported. No patch information is provided in the input data.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an OS Command Injection vulnerability due to improper neutralization of special elements. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability has a CVSS score of 7.2, indicating high severity. No patch or fixed version information is provided in the available data.
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain an SQL injection vulnerability due to improper neutralization of user input in the "profilInput" parameter. This flaw allows a low privileged user to perform SQL injection attacks. The vulnerability has been fixed in PROTECTELMAJ version 6.5.19 and BDF version 6.4.67.