MBasov OMN-Go versionCode 26080824 has insecure permissions that allow unauthorized attackers to invoke an exported component. This vulnerability can lead to arbitrary data access and control of data flow within the application.
NoNonsense Notes versionCode 72600 contains insecure permissions in its NotificationHelper component that allow unauthorized attackers to write to another user's notes by supplying a note ID.
Yet Another UPnP Controller versionCode 50200 contains insecure permissions that allow unauthorized attackers to invoke an exported component. This vulnerability can lead to arbitrary data access and control over application data.
Mirakel v3.0 (versionCode 60) contains insecure permissions in its MirakelInternalContentProvider component, allowing unauthorized attackers to read and modify other users' task databases.
An insecure permission issue in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component. This vulnerability affects the track blocker mechanism of the application, potentially undermining its intended privacy protections.
An insecure permissions vulnerability exists in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400. This flaw allows unauthorized attackers to write arbitrary content into another user's private storage by sending a crafted payload.
An insecure permissions vulnerability exists in the ActivityMain component of the M66B/Marcel Bokhorst NetGuard no-root firewall (versionCode 2026080101/versionName 2.337). This flaw allows unauthorized attackers to force a device reset or cause a Denial of Service (DoS).
An insecure permissions vulnerability in rubenalfon Pile version 1.1.3 allows unauthorized attackers to invoke an exported component, which can lead to arbitrary data access and overwriting.
The wbpxre150 Shopping List application version 11.0 (versionCode 11) contains insecure permissions that allow unauthorized attackers to invoke an exported component. This vulnerability can lead to manipulation of the shopping-list data within the application.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system, potentially enabling network enumeration or aiding other attacks. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system, which may enable network enumeration or support further attacks. The vulnerability has a medium severity rating with a CVSS score of 4.3.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows an authenticated attacker with read or share permissions on a target flow to access the flow owner's stored third-party credentials in cleartext via the API response.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information by exploiting improper limitation of a pathname to a restricted directory. This vulnerability is identified as CWE-22 (Path Traversal).
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request. This flaw results in the loss of in-progress compute work and occurs due to the absence of flow-level permission checks.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to cause a denial of service by exploiting improper neutralization of special elements in OS commands. This flaw does not impact confidentiality or integrity but affects availability.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper neutralization of special elements used in code, which can lead to code injection and execution.
CVE-2025-13050 is a vulnerability involving broken function level authorization that permits an authenticated user to execute poller post-restart commands. This flaw allows users with some level of access to perform actions beyond their intended permissions, potentially impacting system integrity and availability.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper neutralization of special elements used in operating system commands, leading to command injection. The vulnerability has a high severity with a CVSS score of 8.8.
Szafir versions prior to 2.0 build 708 accept any client or server certificate without validating the certificate or hostname. This allows HTTPS connections without authenticating the remote server, enabling an attacker to present arbitrary SSL/TLS certificates and potentially cause the application to download malicious update files from their server. The vulnerability is fixed in version 2.0 build 708.