CVE-2025-30699

CVE-2025-30699 affects Oracle MySQL Server, component: Server: Stored Procedure. Affected versions: 8.0.0–8.0.41, 8.4.0–8.4.4, 9.0.0–9.2.0. An attacker with high privileges and network access via multiple protocols can exploit this to cause a hang or a complete denial of service on MySQL Server. ...

CVE-2025-30687

CVE-2025-30687 affects Oracle MySQL Server (Server: Optimizer). Affected are MySQL versions 8.0.0–8.0.41, 8.4.0–8.4.4, and 9.0.0–9.2.0. The issue allows a network-accessing, low-privilege attacker to cause a hang or frequent crashes (DoS). No exploitation status or in-wild details are provided in...

CVE-2025-21583

Oracle MySQL Server vulnerability CVE-2025-21583 affects the Server: DDL component in MySQL. Affected versions are 8.4.0 and 9.0.0. The issue can be triggered by a high-privileged attacker with network access via multiple protocols, leading to a hang or a frequently repeatable crash (complete DoS...

CVE-2025-31933

CVE-2025-31933 affects Growatt Cloud Applications. An unauthenticated attacker can enumerate usernames by querying an API; CNNVD cites affected versions 3.6.0 and earlier. The issue originates from unauthenticated access to a username list via the API. Red Hat and NVD entries corroborate the basi...

CVE-2025-31933 Growatt Cloud Applications Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can check the existence of usernames in the system by querying an API...

CVE-2025-30511 Growatt Cloud Applications Cross-site Scripting

An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant...

CVE-2025-30511

Growatt Cloud Applications (monitors) is affected by CVE-2025-30511. An authenticated attacker can trigger a stored XSS by exploiting improper sanitization of the plant name value when adding or editing a plant. Documented impact is stored XSS in user spaces; no exploit details are provided beyon...

CVE-2025-30511 Growatt Cloud Applications Cross-site Scripting

An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant...

[SECURITY] Fedora 40 Update: dotnet9.0-9.0.104-1.fc40

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

CVE-2025-24358

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

CVE-2025-24358 gorilla/csrf CSRF vulnerability due to broken Referer validation

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

CVE-2025-24358 gorilla/csrf CSRF vulnerability due to broken Referer validation

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

[SECURITY] Fedora 41 Update: dotnet9.0-9.0.104-1.fc41

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

[SECURITY] Fedora 42 Update: dotnet9.0-9.0.104-1.fc42

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

Growatt Cloud Applications 安全漏洞

Growatt Cloud Applications is a monitoring platform from Growatt, a Chinese company. A security vulnerability exists in Growatt Cloud Applications version 3.6.0 and prior versions, which stems from an attacker being able to export other users' plant information...

Growatt Cloud Applications 安全漏洞

Growatt Cloud Applications is a monitoring platform from Growatt in China. A security bypass vulnerability exists in Growatt Cloud Applications version 3.6.0 and prior versions, which can be exploited by an unauthenticated attacker to add another user's device to a scenario...

Growatt Cloud Applications 跨站脚本漏洞

Growatt Cloud Applications is a monitoring platform from China-based Growatt. A cross-site scripting vulnerability exists in Growatt Cloud Applications 3.6.0 and prior versions, which stems from insufficient server-side input validation and could lead to the injection of malicious JavaScript code...

Growatt Cloud Applications 跨站脚本漏洞

Growatt Cloud Applications is a monitoring platform from China-based Growatt. A cross-site scripting vulnerability exists in Growatt Cloud Applications 3.6.0 and prior versions, which stems from improper cleanup of plant name values when adding or editing plants, and could lead to stored cross-si...

CVE-2025-1275: Heap-based Buffer Overflow

A maliciously crafted JPG file, when linked or imported into certain Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

Growatt Cloud Applications 安全漏洞

Growatt Cloud Applications is a monitoring platform from Growatt, a Chinese company. A security vulnerability exists in Growatt Cloud Applications version 3.6.0 and prior versions, which originates from an unauthenticated attacker being able to gain access to other users' charger information...