CVE-2025-37129

A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system if the feature is...

CVE-2025-37128

A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state...

CVE-2025-59424

CVE-2025-59424: LinkAce contains a Stored XSS on the /system/audit page prior to version 2.3.1. An authenticated attacker can set a malicious payload in the username field; when actions (e.g., API token generation/revocation) are logged, the payload is stored and later executed in the browser of ...

JetBrains TeamCity < 2025.07.2 (CVE-2025-59457) (Windows)

The version of JetBrains TeamCity installed on the remote host is prior to 2025.07.2. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows CVE-2025-59457 Note that Nessus has not tested for this...

CVE-2025-35435

CVE-2025-35435 affects CISA Thorium. The vulnerability arises when Thorium accepts a stream split size of zero and then divides by that value, potentially causing a service crash from a remote, authenticated attacker. The fixed version is implemented in commit 89101a6. Multiple connected document...

CVE-2025-58116

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker...

CVE-2025-55075

CVE-2025-55075 affects I-O DATA WN-7D36QR and WN-7D36QR/UE. A hidden functionality issue may allow a remote authenticated attacker to enable SSH. Impact is that SSH could be enabled remotely (no user interaction required). The issue is exploitable over the network with privileges required as High...

thorium 安全漏洞

thorium is an extensible file analysis and data generation platform from the individual developer mjcarson. A security vulnerability exists in thorium that stems from accepting a zero-valued stream split size and performing a division operation, which could lead to a remote authenticated attacker...

CVE-2025-58116: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker...

CVE-2025-10143: Improper Control of Filename for Include/Require Statement in PHP Program

The Catch Dark Mode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0 via the 'catchdarkmode' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on t...

CVE-2025-35435: Divide By Zero

CISA Thorium accepts a stream split size of zero then divides by this value. A remote, authenticated attacker could cause the service to crash. Fixed in commit 89101a6...

CVE-2025-37127

A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell access. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, potentially...

CVE-2025-37130

A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could allow an attacker to read sensitive data from the underlying file system...

CVE-2025-37128 Authenticated Arbitrary Process Termination allows potential System Disruption in ECOS

A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state...

CVE-2025-37128 Authenticated Arbitrary Process Termination allows potential System Disruption in ECOS

A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state...

CVE-2025-37129

CVE-2025-37129 describes a vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways . An authenticated attacker could exploit the built-in script execution capability to execute arbitrary commands on the underlying operating system if the feature is enabled ...

CVE-2025-37130 Unrestricted Binary allows File Enumeration in Underlying Operating System

A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could allow an attacker to read sensitive data from the underlying file system...

CVE-2025-37130

CVE-2025-37130 affects HPE Aruba EdgeConnect SD-WAN Gateways. A vulnerability in the command-line interface could allow an authenticated attacker to read arbitrary files on the underlying system, exposing sensitive data. The issue is tied to improper access restrictions in the CLI, with the CVSS ...

PT-2025-38090

Name of the Vulnerable Software and Affected Versions EdgeConnect SD-WAN affected versions not specified Description A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could...

PT-2025-38089

Name of the Vulnerable Software and Affected Versions: EdgeConnect SD-WAN affected versions not specified Description: A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful...