CVE-2025-42983 Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis

SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to drop arbitrary SAP database tables, potentially resulting in a loss of data or rendering the system unusable. On successful exploitation, an attacker can completely delete database entries but is not able to read any...

JupyterLab Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of JupyterLab. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additionally, the vulnerability is triggered only when a...

PT-2025-24933 · Unknown · Archiverspaapi

Name of the Vulnerable Software and Affected Versions: ArchiverSpaApi affected versions not specified Description: The ArchiverSpaApi ASP.NET application uses a hard-coded JWT signing key. An unauthenticated remote attacker can generate and use a verifiable JWT token to access protected...

CVE-2025-44044

CVE-2025-44044 affects Keyoti SearchUnit prior to 9.0.0, which is vulnerable to XML External Entity (XXE). An attacker able to force the host to parse crafted XML/DTD can exfiltrate files from the underlying OS. The vulnerability’s practical consequence is unauthorized data disclosure via XML pro...

Microsoft Windows 安全漏洞

Microsoft Windows is a suite of operating systems for use on personal devices by Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Security App. An attacker exploits the vulnerability to perform spoofing attacks...

CVE-2025-41364 Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF

Stored Cross-Site Scripting XSS vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and...

Samba 4.21.x < 4.21.6 / 4.22.x < 4.22.2 Security Bypass Vulnerability

The version of Samba installed on the remote host is 4.21.x prior to 4.21.6, or 4.22.x prior to 4.22.2. It is, therefore, affected by a security bypass vulnerability. A flaw exists with smbd when using Kerberos authentication with smb, due to using the cached user group permissions when...

CVE-2025-32015

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the attribute, which leads to cross-site scripting XSS by loading an attacker's UserJS inside . In order to execute the attack, the attacker needs to control one of the victim's feeds and...

CVE-2025-20279

CVE-2025-20279 affects Cisco Unified CCX (Unified Contact Center Express). The issue is a vulnerability in the web-based management interface where improper sanitization of user input allows an authenticated, remote attacker with valid admin credentials to perform a stored XSS attack. The CVE det...

CVE-2024-48877

A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2025-5236

The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Google Chrome Buffer Overflow Vulnerability

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a buffer overflow vulnerability that can be exploited by an attacker to cause heap corruption...

The vulnerability of Nomad application developers, related to errors in processing hypertext links, allows attackers to compromise the integrity of the protected information.

The vulnerability of Nomad application developers is related to errors in processing hypertext links. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...

CVE-2025-41649 Weidmueller: Out-of-Bounds Write Vulnerability in Industrial Ethernet Switches

An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leading to a denial-of-service condition for the devices...

MGASA-2025-0164 Updated glibc packages fix security vulnerability

An untrusted LDLIBRARYPATH environment variable vulnerability in the GNU C Library versions 2.27 to 2.38 allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen including internal dlopen calls after setlocale or calls to NSS...

CVE-2025-0479

This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system. Successful exploitation of this...

CVE-2024-20417

Multiple vulnerabilities in the REST API of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct blind SQL injection attacks. These vulnerabilities are due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit these...

CVE-2024-3266

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of widgets in all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-23901

Jenkins GitLab Branch Source Plugin 684.veafa7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group...

CVE-2024-24023

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/bookContent/list...