KoreLogic

Latest CVEs · RSS

• CVE-2025-15464 2026-01-08
  Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.
• CVE-2025-54769 2025-07-28
  An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can
• CVE-2025-54768 2025-07-28
  An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The end
• CVE-2025-54767 2025-07-28
  An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user.
• CVE-2025-54765 2025-07-28
  An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The end
• CVE-2025-54766 2025-07-28
  An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The end
• CVE-2025-5100 2025-05-23
  A double-free condition occurs during the cleanup of temporary image files, which can be exploited to achieve memory corruption and potentially arbitrary code e
• CVE-2025-5098 2025-05-23
  PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authorizat
• CVE-2025-5099 2025-05-23
  An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary code
• CVE-2024-13722 2025-02-04
  The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaSc
• CVE-2024-13723 2025-02-04
  The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload a
• CVE-2024-8504 2024-09-10
  An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-202
• CVE-2024-8503 2024-09-10
  An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plainte
• CVE-2024-6893 2024-08-07
  The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read
• CVE-2024-6892 2024-08-07
  Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.
• CVE-2024-6891 2024-08-07
  Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.
• CVE-2024-6890 2024-08-07
  Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the
• CVE-2024-6707 2024-08-07
  Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability.
• CVE-2024-6706 2024-08-07
  Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.