| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| Reserved in error; never associated with a vulnerability. |
| XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed. |
| Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability. |
| Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
| Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”. |
| Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”. |
