EUVD-2022-53191

Malicious code in bioql PyPI...

The vulnerability of the “App Within Minutes Application” (AWM) extension on the XWiki platform allows a hacker to execute arbitrary code.

The vulnerability of the “App Within Minutes Application” AWM extension on the XWiki Platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Flowise has unsandboxed remote code execution via Custom MCP

Summary The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, the default installation of...

The vulnerability of Adobe Experience Manager’s content and media data management system, related to deficiencies in authentication procedures, allows attackers to bypass security restrictions and disclose sensitive information.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to bypass security restrictions and disclose sensitive information...

The vulnerability of the NTLM protocol implementation in Windows operating systems allows attackers to increase their privileges.

The vulnerability of the NTLM protocol implementation in Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...

The vulnerability of the WhatsApp messaging and video call application, related to deficiencies in authentication mechanisms, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the WhatsApp messaging and video call application is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the information protected by the service...

The vulnerability of the SMB server for Windows operating systems allows attackers to increase their privileges.

The vulnerability of the SMB server for Windows operating systems is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

The vulnerability of the Load Rollback() function in the web interface of the microprogramming software for routing and switching platforms RUGGEDCOM RST2428P, SCALANCE XC-300 Series, SCALANCE XC-400 Series, SCALANCE XCM-/XRM-/XCH-/XRH-300 Series, SCALANCE XM-400/XR-500 Series, SCALANCE XR-300 (6GK5334-xTSxx) Series, allows a attacker to compromise the integrity of protected information.

The vulnerability of the Load Rollback function in the web interface of the RUGGEDCOM RST2428P, SCALANCE XC-300 Series, SCALANCE XC-400 Series, SCALANCE XCM-/XRM-/XCH-/XRH-300 Series, SCALANCE XM-400/XR-500 Series, and SCALANCE XR-300 6GK5334-xTSxx Series devices is related to deficiencies in the...

The vulnerability of the integrated Azure Stack Hub hybrid computing system, related to deficiencies in authentication procedures, allows attackers to circumvent existing security restrictions and expose sensitive information.

The vulnerability of the integrated Azure Stack Hub hybrid computing system is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow attackers to bypass existing security restrictions and expose sensitive information...

CVE-2025-54336

In Plesk Obsidian 18.0.70, isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 such as the 0e0 string. This occurs in admin/plib/LoginManager.php...

The vulnerability of Google Chrome’s cookie handling mechanism, related to authentication procedures that allow attackers to escalate their privileges and obtain cookies.

The vulnerability of Google Chrome’s cookie handling mechanism is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges and obtain cookies...

CVE-2025-8943 Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

The vulnerability of the NTLM protocol implementation in Windows operating systems allows attackers to increase their privileges.

The vulnerability of the NTLM protocol implementation in Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...

CVE-2025-40743

CVE-2025-40743 affects multiple Siemens SINUMERIK controllers (828D PPU.4, 828D PPU.5, 840D sl, MC, MC V1.15, ONE, ONE V6.15) with VNC access authentication that does not validate passwords sufficiently. This could enable unauthorized remote access to affected systems and potentially impact confi...

PT-2025-32796

Name of the Vulnerable Software and Affected Versions Windows Installer versions prior to September 2025 Description A weak authentication issue in Windows Installer can allow an authorized attacker to elevate privileges locally. This issue was addressed with a security enhancement in the August...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to access and modify data.

The vulnerability of the Cisco Identity Services Engine ISE’s web management interface is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain access and modify data by sending a specially crafted HTTP request...

The vulnerability of the Single Sign-On component in macOS operating systems allows a perpetrator to gain unauthorized access to confidential data.

The vulnerability of the Single Sign-On component in macOS operating systems is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow attackers to gain unauthorized access to confidential data...

The vulnerability of the SetDDNSSettings() function (/HNAP1/) of the DDNS Service component of the D-Link DIR-823G router’s software, which allows a hacker to circumvent security restrictions.

The vulnerability of the SetDDNSSettings function /HNAP1/ of the DDNS Service component of the D-Link DIR-823G router’s software stack is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to circumvent security restrictions from a...

The vulnerability of the configuration of the Version Control System (VCS) of the Continuous Integration and Delivery Application Framework (CI/CD) tool JetBrains TeamCity allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the TeamCity VCS configuration in continuous integration and delivery systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information from a remote location...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from deficiencies in the authentication process, which allows unauthorized users to gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...