15010 matches found
CVE-2025-59921
An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs...
CVE-2025-58324
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiSIEM 7.2.0 through 7.2.2, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authenticated attacker ...
CVE-2025-58325
An Incorrect Provision of Specified Functionality vulnerability CWE-684 in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands...
CVE-2025-54822
An improper authorization vulnerability CWE-285 vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.11, FortiProxy 7.4.0 through 7.4.8, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions allows an...
CVE-2025-54822
An improper authorization vulnerability CWE-285 vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.11, FortiProxy 7.4.0 through 7.4.8, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions allows an...
CVE-2025-59921
An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs...
CVE-2025-59921
An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs...
CVE-2025-58325
CVE-2025-58325 describes an issue in FortiOS where a local, authenticated attacker can execute system commands via crafted CLI commands. Affected firmware includes FortiOS 7.6.0 and 7.4.0–7.4.5, 7.2.5–7.2.10, 7.0.0–7.0.15, and all 6.4 versions. The vulnerability is categorized as CWE-684 (Incorre...
CVE-2025-58324
FortiSIEM is affected by CVE-2025-58324 in versions 7.2.0 through 7.2.2, 7.1 all versions, 7.0 all versions, and 6.x all versions. The issue is an improper neutralization of input during web page generation (CWE-79) that may allow an authenticated attacker to perform a stored cross-site scripting...
CVE-2025-58324
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiSIEM 7.2.0 through 7.2.2, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authenticated attacker ...
CVE-2025-10986
CVE-2025-10986 affects Ivanti Endpoint Manager Mobile (EPMM) admin panel. A path traversal vulnerability exists in EPMM versions before 12.6.0.2, 12.5.0.4, and 12.4.0.4 that could allow a remote authenticated attacker with admin privileges to write data to unintended locations on disk. Connected ...
Security Advisory Endpoint Manager Mobile (EPMM) 10/2025 (Multiple CVEs)
Security Advisory Endpoint Manager Mobile EPMM Multiple CVEs Summary Ivanti has released updates for EPMM which addresses one medium and three high severity vulnerabilities. Successful exploitation requires authentication and could lead to remote code execution. We are not aware of any customers...
CVE-2025-40755
A vulnerability has been identified in SINEC NMS All versions V4.0 SP1. Affected applications are vulnerable to SQL injection through getTotalAndFilterCounts endpoint. An authenticated low privileged attacker could exploit to insert data and achieve privilege escalation. ZDI-CAN-26570...
CVE-2025-40755
A vulnerability has been identified in SINEC NMS All versions V4.0 SP1. Affected applications are vulnerable to SQL injection through getTotalAndFilterCounts endpoint. An authenticated low privileged attacker could exploit to insert data and achieve privilege escalation. ZDI-CAN-26570...
CVE-2025-40755
A vulnerability has been identified in SINEC NMS All versions V4.0 SP1. Affected applications are vulnerable to SQL injection through getTotalAndFilterCounts endpoint. An authenticated low privileged attacker could exploit to insert data and achieve privilege escalation. ZDI-CAN-26570...
CVE-2025-40755
CVE-2025-40755 affects Siemens SINEC NMS prior to v4.0 SP1. The getTotalAndFilterCounts endpoint is vulnerable to SQL injection, enabling an authenticated low-priv attacker to insert data and escalate privileges. A fix is available in v4.0 SP1 or later (per PT-2025-41881; Siemens ProductCERT advi...
CVE-2025-42910
Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an...
EUVD-2025-34107
SQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary data from the database...