CVE-2009-10006 UFO: Alien Invasion <= 2.2.1 IRC Client Buffer Overflow

UFO: Alien Invasion versions up to and including 2.2.1 contain a buffer overflow vulnerability in its built-in IRC client component. When the client connects to an IRC server and receives a crafted numeric reply specifically a 001 message, the application fails to properly validate the length of...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities due to Apache Kafka ( CVE-2025-27817,CVE-2025-27818 & CVE-2025-27819 )

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Deserialization of Untrusted Data and Server-Side Request Forgery SSRF due to Apache Kafka. Vulnerability Details CVEID:CVE-2025-27818 DESCRIPTION: A possible security vulnerability has been identified in Apache...

Security Bulletin: IBM App Connect for Healthcare is vulnerable to multiple vulnerabilities due to Apache Commons Lang & FileUpload ( CVE-2025-48924 & CVE-2025-48976 )

Summary IBM App Connect for Healthcare is vulnerable to multiple vulnerabilities due to Apache Commons Lang & Apache Commons FileUpload. Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang:...

CVE-2025-49381

Cross-Site Request Forgery CSRF vulnerability in ads.txt Guru ads.txt Guru Connect adstxt-guru-connect allows Cross Site Request Forgery.This issue affects ads.txt Guru Connect: from n/a through = 1.1.1...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Improper Encoding or Escaping of Output due to xmldom ( CVE-2021-32796 )

Summary IBM App Connect Enterprise is vulnerable to Improper Encoding or Escaping of Output due to xmldom. Vulnerability Details CVEID:CVE-2021-32796 DESCRIPTION: xmldom is an open source pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom versions...

SIEMENS Desigo CC family and SENTRON Powermanager elevation of privilege vulnerability

The Desigo CC product range includes Desigo CC, an integrated building management platform for managing high-performance buildings, Desigo CC Compact, a tailored solution for small and medium-sized buildings, Desigo CC Connect, a software gateway based on the Desigo CC platform, and Cerberus DMS ...

PT-2025-34465 · Unknown · Audiobookshelf

Name of the Vulnerable Software and Affected Versions: Audiobookshelf versions 2.6.0 through 2.26.3 Description: Audiobookshelf is an open-source self-hosted audiobook server. The application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a log...

Audiobookshelf 安全漏洞

Audiobookshelf is a self-hosted audiobook and podcast server from Audiobookshelf Open Source. A security vulnerability exists in Audiobookshelf versions 2.6.0 through 2.26.3, which stems from an unrestricted redirect callback URL in the OIDC authentication, which could lead to account takeover...

Cherry pie, Douglas firs and the last trip of the summer

Welcome to this week's edition of the Threat Source newsletter. Diane, 2:01 p.m., August 21st. I've just returned from a remarkable journey through Seattle and the misty roads of the Olympic Peninsula. If you ever find yourself driving beneath those towering Douglas firs or dragged by your partne...

CVE-2025-27213

An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge ADB and make unsupported changes to the system. Affected Products: UniFi Connect EV Station Pro Version 1.5.18 and earlier UniFi Connect Display Versio...

CVE-2025-24285

Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with network access to the UniFi Connect EV Station Lite. Affected Products: UniFi Connect EV Station Lite Version 1.5.1 and earlier Mitigation: Update UniFi...

CVE-2025-27214

A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical or adjacent access to perform an unauthorized factory reset. Affected Products: UniFi Connect EV Station Pro Version 1.5.18 and earlier Mitigation: Update Uni...

CVE-2025-27215

An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to the system. Affected Products: UniFi Connect Display Cast Version 1.10.3 and earlier UniFi Connect Display Cast Pro Version 1.0.89 and...

CVE-2025-27214

A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical or adjacent access to perform an unauthorized factory reset. Affected Products: UniFi Connect EV Station Pro Version 1.5.18 and earlier Mitigation: Update Uni...

CVE-2025-24285

CVE-2025-24285 affects UniFi Connect EV Station Lite (versions 1.5.1 and earlier). The issue is described as multiple improper input validation vulnerabilities that may allow a malicious actor with network access to perform command injection on the EV Station Lite. The CVSS 3.1 score is listed as...

CVE-2025-24285

Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with network access to the UniFi Connect EV Station Lite. Affected Products: UniFi Connect EV Station Lite Version 1.5.1 and earlier Mitigation: Update UniFi...

CVE-2025-27213

An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge ADB and make unsupported changes to the system. Affected Products: UniFi Connect EV Station Pro Version 1.5.18 and earlier UniFi Connect Display Versio...

CVE-2025-27213

The CVE-2025-27213 entry concerns several UniFi Connect devices with an improper access control in the API that could allow a malicious actor already authenticated to enable Android Debug Bridge (ADB) and perform unsupported system changes. Affected products and versions are: UniFi Connect EV Sta...

Ubiquiti多款产品 安全漏洞

Ubiquiti UniFi Connect EV Station and others are products of Ubiquiti, Inc.Ubiquiti UniFi Connect EV Station is an electric vehicle station.Ubiquiti UniFi Connect Display is an access control system monitor device. Ubiquiti UniFi Connect Display Cast is a player. A security vulnerability exists i...

PT-2025-34173 · Ubiquiti · Unifi Connect Ev Station Pro

Name of the Vulnerable Software and Affected Versions: UniFi Connect EV Station Pro versions 1.5.18 and earlier Description: A missing authentication check for critical functions in UniFi Connect EV Station Pro could allow an attacker with physical or adjacent access to perform an unauthorized...