CVE-2025-54158

Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors...

CVE-2025-54158

CVE-2025-54158 affects Synology BeeDrive for desktop prior to 1.4.2-13960. The issue is a missing authentication check in a critical function, enabling local users to potentially execute arbitrary code via unspecified vectors. Multiple connected sources (Red Hat, NVD, CVE lists, and vendor adviso...

Synology BeeDrive 路径遍历漏洞

Synology BeeDrive is a backup and synchronization appliance from China-based Synology. A path traversal vulnerability exists in Synology BeeDrive versions prior to 1.4.2-13960, which stems from an improperly restricted pathname and could lead to the execution of arbitrary code by a local user...

Synology BeeDrive 安全漏洞

Synology BeeDrive is a backup and synchronization appliance from China-based Synology Inc. A security vulnerability exists in Synology BeeDrive versions prior to 1.4.2-13960, which stems from a lack of authorization and could lead to a remote attacker deleting arbitrary files...

Synology BeeDrive 访问控制错误漏洞

Synology BeeDrive is a backup and synchronization appliance from China-based Synology Inc. An access control error vulnerability exists in Synology BeeDrive versions prior to 1.4.2-13960, which stems from a lack of authentication for critical functions and could lead to the execution of arbitrary...

PT-2025-49037

Name of the Vulnerable Software and Affected Versions Synology BeeDrive for desktop versions prior to 1.4.2-13960 Description A missing authentication check exists for a critical function within BeeDrive. This flaw allows local users to potentially execute arbitrary code through unspecified...

PT-2025-49038

Name of the Vulnerable Software and Affected Versions Synology BeeDrive for desktop versions prior to 1.4.2-13960 Description A missing authorization flaw exists in BeeDrive. This allows remote attackers to delete arbitrary files through unspecified means. Recommendations Update Synology BeeDrive...

EUVD-2025-199784

The Soundslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the soundslides shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2025-12713 Soundslides <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundslides Shortcode

The Soundslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the soundslides shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

PT-2025-48222

The Soundslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the soundslides shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

WordPress plugin Soundslides 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Soundslides plugin <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundslides Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via soundslides Shortcode vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Soundslides versions = 1.4.2...

SUSE CVE-2025-65015

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause...

TencentOS Server 3: yajl (TSSA-2022:0235)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0235 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ExceededSizeError exception. An attacker can cause excessive memory consumption and potentially disrupt service availability by sending arbitrarily large JWT tokens in HTTP...

UBUNTU-CVE-2025-65015

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause...

CVE-2025-65015

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause...

PT-2025-47405

Name of the Vulnerable Software and Affected Versions joserfc versions 1.3.3 through 1.3.4 joserfc versions 1.4.0 through 1.4.1 Description The joserfc library has an issue where excessively large JWT JSON Web Token payloads can be logged, potentially leading to resource exhaustion. Specifically,...

CVE-2025-55810

A vulnerability was found in Alaga Home Security WiFi Camera 3K model S-CW2503C-H with hardware version V03 and firmware version 1.4.2, which allows physical attackers to execute commands as root via script file with a specific name on a SD card...

PT-2025-46892

🚨 CVE-2025-55810 A vulnerability was found in Alaga Home Security WiFi Camera 3K model S-CW2503C-H with hardware version V03 and firmware version 1.4.2, which allows physical attackers to execute commands as root via script file with a specific name on a SD card. 🎖@cveNotify...