AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 contain a vulnerability where cryptographic signatures for JSON Web Tokens (JWT) are not correctly verified. This flaw allows a remote, unauthenticated attacker to forge a valid-looking JWT without a proper signature and perform privileged actions. The issue is fixed in version 9.2.41.
AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 have a critical vulnerability that allows unauthenticated remote attackers to send requests via the management API '/bss/sysmgnt/api/'. This flaw enables attackers to provision new administrative accounts or take over existing ones, leading to full administrative control. The vulnerability is fixed in version 9.2.41.
N-able N-central before version 26.4.1 contains a vulnerability due to improper neutralization of HTTP headers, which allows Cross-Site Scripting (XSS) attacks. This vulnerability is identified as CVE-2026-125880 and has a high severity score of 8.3. It affects versions prior to 26.4.1 and requires user interaction with high privileges for exploitation.
N-able N-central before version 26.4.1 contains an XML external entity (XXE) vulnerability that allows XML Schema Poisoning. This vulnerability is classified under CWE-611 and has a critical CVSS 4.0 score of 9.3. It enables attackers to exploit improper restrictions on XML external entity references.
CAI Content Credentials suffers from an improper verification of cryptographic signatures vulnerability that allows an attacker to bypass security features and gain unauthorized write access. Exploitation does not require user interaction but depends on conditions beyond the attacker's control. The vulnerability has a medium severity rating with a CVSS score of 5.9.
CAI Content Credentials has a vulnerability involving improper verification of cryptographic signatures, which could allow an attacker to bypass security features and gain unauthorized write access without requiring user interaction. Exploitation depends on conditions outside the attacker's control. The vulnerability has a medium severity rating with a CVSS score of 5.9.
CAI Content Credentials suffers from an improper input validation vulnerability that can lead to a security feature bypass. This flaw allows an attacker to gain unauthorized limited write access without requiring any user interaction. The vulnerability has a medium severity rating with a CVSS score of 4.0. No affected versions or patches have been specified.
Adobe Connect contains a stored Cross-Site Scripting (XSS) vulnerability that allows a low-privileged attacker to inject malicious scripts into form fields. When a victim views the affected page, the malicious JavaScript executes in their browser, potentially enabling the attacker to elevate access or control over the victim's account or session. The vulnerability impacts confidentiality and integrity but does not affect availability.
A vulnerability in the request-callout plugin of Kong Gateway Enterprise and Kong AI Gateway causes omission of callout headers not sent by the client from the cache key. This flaw allows cached callout responses intended for one caller to be served to another, potentially leading to incorrect or unauthorized data being returned.
Adobe Experience Manager suffers from a DOM-based Cross-Site Scripting (XSS) vulnerability that allows attackers to execute malicious JavaScript by manipulating the DOM environment. Exploitation requires user interaction, specifically visiting a crafted webpage. The vulnerability changes the security scope and has a medium severity rating.
CAI Content Credentials suffers from an improper input validation vulnerability that can allow an attacker to bypass security features and gain unauthorized limited write access. Exploitation does not require user interaction but depends on conditions outside the attacker's control. The vulnerability has a low severity rating with a CVSS score of 3.7.
Adobe Experience Manager contains a stored Cross-Site Scripting (XSS) vulnerability that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a user visits a page with the injected script, the malicious JavaScript executes in their browser. This vulnerability affects confidentiality and integrity but does not impact availability. The vulnerability has a medium severity score of 5.4.
CAI Content Credentials suffers from an Incorrect Authorization vulnerability (CWE-863) that allows an attacker to bypass security features and gain unauthorized limited write access. Exploitation does not require user interaction but depends on conditions outside the attacker's control. The vulnerability has a low CVSS score of 2.9, indicating limited impact.
CAI Content Credentials has an Uncontrolled Resource Consumption vulnerability (CWE-400) that can be exploited to cause application denial-of-service. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page. The vulnerability does not impact confidentiality or integrity but can cause service disruption.
Adobe Connect contains a critical SQL Injection vulnerability that allows a low-privileged attacker to execute arbitrary SQL commands without user interaction. This flaw could lead to arbitrary code execution in the context of the current user and potentially result in elevated access or control over user accounts or sessions. The vulnerability affects the scope of the application and poses a high risk to confidentiality, integrity, and availability.
Adobe Connect has an Incorrect Authorization vulnerability (CVE-2026-121913) that allows a low-privileged attacker to escalate privileges without user interaction. This vulnerability can lead to unauthorized access to sensitive information and critical functionality.
Adobe Connect contains a critical SQL Injection vulnerability that allows an attacker to execute arbitrary SQL commands without user interaction. This flaw could lead to arbitrary code execution, impacting the confidentiality, integrity, and availability of the application.
Adobe Connect suffers from a critical path traversal vulnerability that allows an attacker with limited privileges to read arbitrary files on the system without user interaction. This vulnerability changes the security scope and can lead to full confidentiality, integrity, and availability compromise.
Adobe Connect contains a Cross-Site Scripting (XSS) vulnerability that allows a low-privileged attacker to execute malicious JavaScript in a victim's browser if the victim visits a crafted URL referencing a vulnerable page. This vulnerability affects the security context of the victim's session and requires user interaction. The vulnerability has a medium severity rating with a CVSS score of 5.4.
Adobe Connect contains a SQL Injection vulnerability that allows a low-privileged attacker to execute arbitrary SQL commands without user interaction. This flaw could lead to arbitrary code execution within the context of the current user. The vulnerability is rated high severity with a CVSS score of 8.3.