CVE-2025-36599

Summary: Dell PowerFlex Manager VM (Dell PowerFlex Manager VM) versions before 4.6.2.1 are affected by an insertion of sensitive information into log files. A low-privileged, remote attacker could exploit this to disclose user credentials and potentially access the system with the compromised acc...

CVE-2025-7059

The Simple Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slideshow’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

The vulnerability of the microprogrammed Ethernet module software WISE-4010LAN, WISE-4050LAN, and WISE-4060LAN lies in the unencrypted storage of critical information, allowing attackers to gain unauthorized access to protected data.

The vulnerability of the microprogrammed Ethernet module software WISE-4010LAN, WISE-4050LAN, and WISE-4060LAN is related to the unencrypted storage of critical information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected informati...

CVE-2025-49544 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or...

CVE-2024-49783

IBM OpenPages with Watson 8.3 and 9.0 are affected by CVE-2024-49783, which describes weaker-than-expected encryption data storage. An authenticated remote attacker with database access or a local attacker with server-file access could extract encrypted data and potentially apply additional crypt...

CVE-2025-6996 Improper Encryption in Ivanti Endpoint Manager

Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords...

USN-7625-1: OnionShare vulnerabilities

It was discovered that OnionShare could be exploited when run with the --debug argument. A local attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. CVE-2018-19960 It was discovered that OnionShare could be blocke...

CVE-2025-40742

A vulnerability has been identified in SIPROTEC 5 6MD84 CP300 All versions V11.0, SIPROTEC 5 6MD85 CP200 All versions, SIPROTEC 5 6MD85 CP300 All versions V11.0, SIPROTEC 5 6MD86 CP200 All versions, SIPROTEC 5 6MD86 CP300 All versions V11.0, SIPROTEC 5 6MD89 CP300 All versions V11.0, SIPROTEC 5...

CVE-2025-21003

Insecure storage of sensitive information in Emergency SOS prior to SMR Jul-2025 Release 1 allows local attackers to access sensitive information...

Microsoft SharePoint 授权问题漏洞

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

PT-2025-28576 · Microsoft · Windows Ntfs +1

Name of the Vulnerable Software and Affected Versions: Windows NTFS affected versions not specified Description: A null pointer dereference issue in Windows NTFS allows an authorized attacker to elevate privileges locally. The issue was fixed in the Windows July Patch Tuesday. Recommendations: At...

The vulnerability of the HarmonyOS operating system, related to buffer overflows in the stack, allows attackers to compromise the accessibility of protected information.

The vulnerability of the HarmonyOS operating system is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...

PT-2025-28504 · Microsoft · Service Fabric

Name of the Vulnerable Software and Affected Versions: Service Fabric affected versions not specified Description: The issue concerns improper link resolution before file access, also known as 'link following', which allows an authorized attacker to elevate privileges locally. This could...

CVE-2025-6801 Marvell QConvergeConsole saveNICParamsToFile Directory Traversal Arbitrary File Write Vulnerability

Marvell QConvergeConsole saveNICParamsToFile Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specif...

CVE-2025-52492

A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6. The firmware file, rootfs.tar.gz, contains hard-coded credentials for the Twilio API. A remote attacker who obtains a copy of the firmware can extract these credentials. This could allow the attacker to gain...

The vulnerability of the Linux operating system’s kernel Wi-Fi component, which allows a hacker to gain access to confidential data

The vulnerability of the Linux operating system’s kernel Wi-Fi component is related to reading data from buffer files beyond the allowed limits. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

CVE-2025-5014

The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wpremcswidgetfiledelete' function in all versions up to, and including, 2.8. This makes it possible for authenticated attackers, with...

CVE-2025-6071 Hard Coded Key used for AES encryption

Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. An attacker can gain access to salted information to decrypt MQTT information. This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016...

CVE-2025-1708

CVE-2025-1708 affects the Endress+Hauser MEAC300-FNADE4 (Endress+Hauser) through an SQL injection vulnerability. The included documents consistently describe that an attacker can exploit improper validation to dump/read data from the PostgreSQL back-end database (and potentially view/add/modify/d...

The vulnerability of the arch/x86 kernel component of the Linux operating system, which allows a hacker to gain access to confidential data

The vulnerability of the arch/x86 kernel component of the Linux operating system is related to the exposure of information through mismatches. Exploiting this vulnerability can allow an attacker to gain access to confidential data...