Common Vulnerabilities and Exposures

Local file inclusion in Ready_ Symfonia eDokumenty allows attackers to read arbitrary files from the server filesystem

SQL injection in Ready_ Symfonia eDokumenty allows attackers to execute arbitrary SQL queries against the backend database

Remote code execution in Ready_ Symfonia eDokumenty allows unauthenticated attackers to execute arbitrary commands on the server

TCC Bypass via Inherited Permissions in Bundled Interpreter in Inkscape.app

TCC Bypass via Inherited Permissions in Bundled Interpreter

Remote code execution via CSV injection in Proget Console - activation data containing malicious formulas executes when opened in Excel

Stored XSS via unsanitized activation messages in Proget Console allows attackers to execute JavaScript in victim browsers

Stored cross-site scripting in Proget Console comments allows high-privileged users to inject malicious scripts affecting other administrators

Authorization bypass in Proget MDM allows low-privileged users to access MDM profiles revealing allowed and blocked device features

Insecure direct object reference in Proget MDM allows low-privileged users to view sensitive backup data including UUIDs, names, and emails

Authorization bypass in Proget MDM allows low-privileged users to retrieve device passwords using UUIDs obtained from other vulnerabilities

Broken access control in Proget MDM allows low-privileged users to enumerate task and device details including UUIDs via brute-force

Dylib hijacking in DaVinci Resolve allows local attackers to execute arbitrary code with application privileges

Insecure Password Storage in Y Soft SafeQ 6

Local privilege escalation vulnerability in Sparkle autoupdate daemon allows local attackers to elevate privileges to root on macOS systems