This vulnerability involves the logging of irrelevant properties by an Event Publisher output adapter, which can include sensitive user credentials or confidential information if misconfigured. An attacker with access to the 'wso2carbon' log files could extract this sensitive data, potentially leading to unauthorized access. The issue is due to improper handling of configuration properties in logging.
CVE-2025-13647 is a vulnerability where the affected component does not properly validate the content-type header in certain requests. This flaw allows attackers to craft requests with manipulated content-type headers, leading to unintended exposure of file paths for certificate files. The information disclosure could aid attackers in further compromising system confidentiality. The vulnerability has a medium severity with a CVSS score of 5.8.
CVE-2024-9517 is a vulnerability in WSO2 products where the refresh token grant type does not re-validate the account status before issuing new access tokens. This flaw allows attackers to obtain valid access tokens for accounts that have been blocked, bypassing account lockout protections. The vulnerability can lead to unauthorized access and potential privilege escalation or data exfiltration depending on the compromised account's permissions.
ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 have a vulnerability that allows authenticated users to execute remote code via the Log Forward option. This vulnerability has a high severity score of 8.7 and requires high privileges to exploit, with no user interaction needed.
CVE-2025-12544 is a vulnerability in the Publisher portal where insufficient validation of uploaded SVG files allows users with the Publisher role to inject malicious scripts. Exploitation involves uploading crafted SVG files that are stored and rendered by the application, enabling actions such as browser redirection, UI modification, or information retrieval. The impact is limited by httpOnly flags on session cookies, preventing session hijacking.
CVE-2026-2613 is a high-severity vulnerability in the Admin REST API where user input is not properly sanitized, allowing an administrator to perform blind SQL injection. This can lead to unauthorized inference of database information and potentially disrupt database availability.
CVE-2024-2372 is an open redirection vulnerability where affected components accept user input for redirection URLs without proper validation. This flaw allows attackers to craft URLs that redirect users to arbitrary external domains, facilitating phishing attacks through social engineering.
CVE-2024-7075 is a cross-site scripting (XSS) vulnerability in the user search function of a management console. The function does not properly encode user input before rendering it in the browser, allowing attackers to inject malicious scripts. Exploitation can lead to browser redirection, UI manipulation, or information disclosure from the browser. The vulnerability does not allow session hijacking due to the httpOnly flag on session cookies.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a Cross-site Scripting (CWE-79) vulnerability. This flaw allows an unauthenticated remote attacker to potentially tamper with information by injecting malicious scripts. The vulnerability has a CVSS 3.1 score of 6.8, indicating a medium severity. A fix is available in version 4.8.0 and later.
The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.
An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability involving improper verification of cryptographic signatures. This flaw allows a high privileged attacker with adjacent network access to potentially execute code on the affected system. The vulnerability is identified as CWE-347 and has a CVSS v3.1 score of 5.7, indicating medium severity. A fix is available in version 4.8.0 and later.
A heap-based buffer overflow vulnerability exists in the SPDY dissector of Wireshark, a network protocol analyzer. This flaw can lead to a denial of service condition. Red Hat has issued a security update addressing this vulnerability in Wireshark packages for Red Hat Enterprise Linux 8 and related products.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.
CVE-2026-91910 is a path traversal vulnerability in Dell OpenManage Enterprise versions prior to 4.8.0. It allows a low privileged attacker with adjacent network access to potentially expose sensitive information by improperly restricting pathname access. The vulnerability has a medium severity with a CVSS score of 5.7.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
A security vulnerability (CVE-2026-32597) exists in the PyJWT library used in Python, where it accepts unknown 'crit' header extensions, violating RFC 7515 section 4.1.11 requirements. This issue has been addressed by Red Hat in an update for python-jwt packages on Red Hat Enterprise Linux 8.8 variants.
Two critical PHP vulnerabilities affect older deployments of Festo Didactic MES4 products using XAMPP with PHP versions up to 7.3, which are out-of-support and unpatched. Mitigations recommended by the PHP foundation include setting memory_limit=-1 and disabling session upload progress in php.ini, with an optional Apache configuration change that impacts performance. Additional firewall restrictions on the Windows host are suggested to limit communication to trusted sources.
The Apache Thrift Rust crate versions prior to 0.23.0 contain a vulnerability in the TBinaryInputProtocol's read_bytes function, where an attacker-controlled 4-byte length value is used directly to allocate a buffer without bounds checking. This can lead to excessive memory allocation or immediate process abort, causing a denial of service. The issue affects any peer sending binary protocol data and is unauthenticated and network-reachable. The vulnerability is fixed in version 0.23.0 by adding checks against negative sizes and enforcing a maximum string size limit.