CVE-2025-42903 User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management

A vulnerability in SAP Financial Service Claims Management RFC function ICLUSERGETNAMEANDADDRESS allows user enumeration and potential disclosure of personal data through response discrepancies, causing low impact on confidentiality with no impact on integrity or availability...

Rockwell Automation Comms-1783-NATR 安全漏洞

Rockwell Automation Comms-1783-NATR is an industrial Ethernet address translation device from Rockwell Automation. A security vulnerability exists in the Rockwell Automation Comms-1783-NATR that stems from a lack of authentication checks for critical functions and can be exploited by an attacker ...

PT-2025-41906

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 144 Description A malicious webpage could create a fake address bar to deceive users when the address bar was hidden due to scrolling on Android devices. This occurred in response to a visibilitychange event...

Security Vulnerabilities fixed in Firefox 144 — Mozilla

Use-after-free in MediaTrackGraphImpl::GetInstance A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. A compromised web process using malicious IPC messages could have caused the privileged browser process to...

SAP Financial Service Claims Management 安全漏洞

SAP Financial Service Claims Management is a financial services web platform from SAP, Germany. A security vulnerability exists in SAP Financial Service Claims Management that stems from a response discrepancy in the ICLUSERGETNAMEANDADDRESS RFC function, which could lead to user enumeration and...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the AccountEntriesAdminPortletaddressId parameter. An attacker can access address information belonging to other accounts by specifying arbitrary identifiers. Remediation Upgrade...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the AccountEntriesAdminPortletaddressId parameter. An attacker can access address information belonging to other accounts by specifying arbitrary identifiers. Remediation Upgrade...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the AccountEntriesAdminPortletaddressId parameter. An attacker can access address information belonging to other accounts by specifying arbitrary identifiers. Remediation Upgrade...

Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key

Insecure Direct Object Reference IDOR vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses fr...

EUVD-2025-34078

Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key...

CVE-2025-62242

Insecure Direct Object Reference IDOR vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses fr...

CVE-2025-62242

Insecure Direct Object Reference IDOR vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses fr...

CVE-2025-62242

CVE-2025-62242 describes an IDOR in Liferay, affecting Liferay Portal 7.4.3.4–7.4.3.111 and Liferay DXP 2023.Q3.1–Q4.5, plus 7.4 GA up to update 92. The vulnerability allows remote authenticated users to view addresses from another account by supplying AccountEntriesAdminPortlet_addressId in the ...

CVE-2025-62242

Insecure Direct Object Reference IDOR vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses fr...

EUVD-2025-33913

A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TFFQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are high...

UTT HiPER 2620G 安全漏洞

The UTT HiPER 2620G is an enterprise router from China Aitai UTT. A security vulnerability exists in UTT HiPER 2620G 3.1.4 and earlier versions, which originates from a misbehavior of the function strcpy in the file /goform/fNTP with respect to the parameter NTPServerIP, which may result in a...

EBM Uniweb/SoliPACS WebServer 访问控制错误漏洞

EBM Uniweb/SoliPACS WebServer is a medical image archiving and communication system from Enterprise Business Machine EBM, Inc. of Taiwan, China. An access control error vulnerability exists in the EBM Uniweb/SoliPACS WebServer that stems from a lack of authentication, which could allow an...

Liferay DXP 安全漏洞

Liferay DXP is a suite of digital experience collaboration platforms from Liferay USA. A security vulnerability exists in Liferay DXP versions 2023.Q4.1 through 2023.Q4.5, which stems from the comliferaycommerceorderwebinternalportletCommerceOrderPortletcommerceOrderId An insecure direct object...

AndSoft e-TMS Cross-Site Scripting Vulnerability (CNVD-2025-23568)

AndSoft e-TMS is a logistics management software from AndSoft Spain. A cross-site scripting vulnerability exists in AndSoft e-TMS, which originates from a lack of effective filtering and escaping of user-supplied data in parameter l of the /clt/TRACKREQUEST.ASP file, which can be exploited by an...

PT-2025-41801

Name of the Vulnerable Software and Affected Versions Mattermost Desktop App versions through 5.13.0 Description The Mattermost Desktop App does not properly validate URLs originating from outside the configured Mattermost servers. This allows a malicious server to cause the application to crash ...