CVE-2025-8059

The CVE refers to the WordPress B Blocks plugin (versions up to 2.0.6) with a privilege-escalation flaw caused by missing authorization and input validation in the rgfr_registration() function. This allows unauthenticated attackers to create a new account and grant it the administrator role. Publ...

PT-2025-32855

Name of the Vulnerable Software and Affected Versions Windows versions prior to August 2025 Patch Tuesday Description A relative path traversal vulnerability exists in the Windows Kerberos implementation. This flaw allows an authorized attacker to elevate privileges on a network. The vulnerabilit...

Linux Distros Unpatched Vulnerability : CVE-2019-9812

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that...

Linux Distros Unpatched Vulnerability : CVE-2025-34034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A hardcoded credential vulnerability exists in the Blue Angel Software Suite deployed on embedded Linux systems. The application contains multiple known default...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices versions prior to SMR Aug-2025 Release 1, which stems from improper privilege management and...

CVE-2025-54573

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced when using Basic HTTP Authentication. As a result, users could create accounts using fake email addresses and use the product as verified...

Attackers Use Fake OAuth Apps with Tycoon Kit to Breach Microsoft 365 Accounts

Cybersecurity researchers have detailed a new cluster of activity where threat actors are impersonating enterprises with fake Microsoft OAuth applications to facilitate credential harvesting as part of account takeover attacks. "The fake Microsoft 365 applications impersonate various companies,...

IR Trends Q2 2025: Phishing attacks persist as actors leverage compromised valid accounts to enhance legitimacy

Phishing remained the top method of initial access this quarter, appearing in a third of all engagements - a decrease from 50 percent last quarter. Threat actors largely leveraged compromised internal or trusted business partner email accounts to deploy malicious emails, bypassing security contro...

The vulnerability of the SmartFabric OS10 network operating system, related to the use of pre-installed user accounts, allows a perpetrator to escalate their privileges.

The vulnerability of the SmartFabric OS10 network operating system is related to the use of pre-installed user accounts. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVAT.ai CVAT 授权问题漏洞

CVAT.ai CVAT is an open source data processing tool from CVAT.ai. An authorization issue vulnerability exists in CVAT.ai CVAT versions 1.1.0 to 2.41.0, which stems from not enforcing email validation, and could lead to account creation and bot registration using a fake email address...

CVE-2025-54596

Abnormal Security /v1.0/rbac/usersv2/USERID/ before 2025-02-19 allows downgrading the privileges of other user accounts...

CVE-2025-45731

A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending...

CVE-2025-54596

Abnormal Security /v1.0/rbac/usersv2/USERID/ before 2025-02-19 allows downgrading the privileges of other user accounts...

CVE-2025-54596

Abnormal Security /v1.0/rbac/usersv2/USERID/ before 2025-02-19 allows downgrading the privileges of other user accounts...

CVE-2025-54596

Abnormal Security /v1.0/rbac/usersv2/USERID/ before 2025-02-19 allows downgrading the privileges of other user accounts...

CVE-2025-45731

A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending...

CVE-2025-45731

A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending...

CVE-2025-45731

CVE-2025-45731 relates to a group deletion race condition in the 2FAuth v5.5.0 application. The issue arises when a group is deleted while other operations are pending, leading to data inconsistencies and orphaned accounts. The connected documents confirm the affected product and the underlying c...

CVE-2025-45731

A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending...

2FAuth 安全漏洞

2FAuth is a web application from Bubka Personal Developers for managing two-factor authentication 2FA accounts and generating their security codes. A security vulnerability exists in 2FAuth version v5.5.0 that stems from a group deletion contention condition that could lead to data inconsistencie...