CVE-2025-8616

CVE-2025-8616 affects OpenText OpenText Advanced Authentication (versions up to and including 6.5.0). A malicious browser plugin can record and replay the user authentication process to bypass authentication, representing a replay attack against the login flow. The vulnerability’s root cause is t...

Ring: some aes functions may panic when overflow checking is enabled in ring

...

OpenText Advanced Authentication 安全漏洞

OpenText Advanced Authentication is an advanced authentication framework from OpenText Canada. A security vulnerability exists in OpenText Advanced Authentication version 6.5.0 and earlier, which originates from a malicious browser plug-in that can record and replay the user authentication proces...

PT-2025-32173 · Opentext · Opentext Advance Authentication

Name of the Vulnerable Software and Affected Versions: OpenText Advanced Authentication versions prior to 6.5.0 Description: A weakness exists in OpenText Advanced Authentication that allows a malicious browser plugin to record and replay the user authentication process, bypassing authentication...

Tigo Energy Cloud Connect Advanced 信任管理问题漏洞

Tigo Energy Cloud Connect Advanced is a compact data logger from Tigo Energy USA. A trust management issue vulnerability exists in Tigo Energy Cloud Connect Advanced, which stems from hard-coded credentials and could lead to elevated privileges...

Tigo Energy Cloud Connect Advanced 安全漏洞

Tigo Energy Cloud Connect Advanced is a compact data logger from Tigo Energy USA. A security vulnerability exists in Tigo Energy Cloud Connect Advanced that stems from insecure session ID generation that could lead to unauthorized access...

Tigo Energy Cloud Connect Advanced 命令注入漏洞

The Tigo Energy Cloud Connect Advanced is a compact data logger from Tigo Energy USA. Tigo Energy Cloud Connect Advanced suffers from a command injection vulnerability due to a flaw in the /cgi-bin/mobileapi endpoint when the DEVICEPING command is invoked. An attacker could exploit the...

CVE-2012-10025 WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion

The WordPress plugin Advanced Custom Fields ACF version 3.5.1 and below contains a remote file inclusion RFI vulnerability in core/actions/export.php. When the PHP configuration directive allowurlinclude is enabled default: Off, an unauthenticated attacker can exploit the acfabspath POST paramete...

CVE-2012-10025 WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion

The WordPress plugin Advanced Custom Fields ACF version 3.5.1 and below contains a remote file inclusion RFI vulnerability in core/actions/export.php. When the PHP configuration directive allowurlinclude is enabled default: Off, an unauthenticated attacker can exploit the acfabspath POST paramete...

CVE-2012-10025

The WordPress plugin Advanced Custom Fields ACF version 3.5.1 and below contains a remote file inclusion RFI vulnerability in core/actions/export.php. When the PHP configuration directive allowurlinclude is enabled default: Off, an unauthenticated attacker can exploit the acfabspath POST paramete...

CVE-2012-10025

The CVE-2012-10025 entry concerns the WordPress plugin Advanced Custom Fields (ACF)

kernel: information leak via transient execution vulnerability in some AMD processors

A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information...

PT-2025-32226 · Tigo Energy · Cloud Connect Advanced

Name of the Vulnerable Software and Affected Versions: Tigo Energy Cloud Connect Advanced CCA affected versions not specified Description: Tigo Energy's Cloud Connect Advanced CCA device contains hard-coded credentials that allow unauthorized users to gain administrative access. This allows...

WordPress plugin Advanced Custom Fields 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

Security update for kernel-livepatch-MICRO-6-0_Update_2

This update for kernel-livepatch-MICRO-6-0Update2 fixes the following issues: CVE-2024-50208: RDMA/bnxtre: Fix a bug while setting up Level-2 PBL pages bsc1233118 CVE-2024-50250: fsdax: daxunshareiter needs to copy entire blocks bsc1233227 CVE-2024-53146: NFSD: prevent a potential integer overflo...

CVE-2025-7845 Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets

The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widgets in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...

CVE-2025-7845 Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets

The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widgets in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...

SleepWalk: Exploiting Context Switching and Residual Power for Physical Side-Channel Attacks

Context switching is utilized by operating systems to change the execution context between application programs. It involves saving and restoring the states of multiple registers and performing a pipeline flush to remove any pre-fetched instructions, leading to a higher instantaneous power...

CVE-2024-43018

Piwigo 13.8.0 and earlier is vulnerable to SQL injection via the max_level and min_register parameters. The issue arises in the ws_user_gerList function (include\ws_functions\pwg.users.php), invoked by ws.php and reachable from /admin.php?page=user_list. This can allow attacker-controlled SQL man...

The vulnerability of the formSetIptv() function in the microprogramming software for the Tenda AX1803 allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the formSetIptv function in the microprogramming software for the Tenda AX1803 router is related to buffer overflows in the stack during the processing of the adv.iptv.stballvlans parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a...