CVE-2025-6137 TOTOLINK T10 HTTP POST Request cstecgi.cgi setWiFiScheduleCfg buffer overflow

A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207. Affected is the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the...

CVE-2025-6120

A vulnerability has been discovered in the Open Asset Import Library Assimp, specifically within the readmeshes functionality of the assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp file related to Half-Life 1 MDL file loading. This flaw can lead to a heap-based buffer overflow. Under specific...

CVE-2025-49796

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined...

CVE-2025-6129

CVE-2025-6129 affects TOTOLINK EX1200T (version 4.1.2cu.5232_B20210713). The HTTP POST Request Handler’s /boafrm/formSaveConfig endpoint accepts a submit-url parameter and, when manipulated, can cause a buffer overflow. This allows remote exploitation, and public disclosure is noted. Connected so...

CVE-2025-49796

creationtimestamp| type| source ---|---|--- 2025-06-16 15:39:56+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18461 2025-06-16 16:24:04+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114693966654084445 2025-06-16 16:33:33+00:00| seen|...

CVE-2025-6170

CVE-2025-6170 affects libxml2’s xmllint interactive shell. A stack-based buffer overflow in the command-parsing logic can cause crashes and, in rare configurations, may allow code execution. Related connected documents show patches/updates across distributions: Debian LTS advisory and Debian secu...

CVE-2025-6170

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare...

CVE-2025-49795

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service...

CVE-2025-49125

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by th...

CVE-2025-6122

creationtimestamp| type| source ---|---|--- 2025-06-16 14:38:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18459 2025-06-16 15:28:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrqc7ndydr2m...

CVE-2025-48988

creationtimestamp| type| source ---|---|--- 2025-06-16 14:38:10+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18455 2025-06-16 15:16:27+00:00| seen| https://seclists.org/oss-sec/2025/q2/252 2025-06-16 15:40:25+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114693794996406990...

CVE-2025-5689 Improper Permission Management in SSH Session Handling

A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part of the root group in the context of that SSH session...

CVE-2025-6119

A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHLoader::ReadNodeChannels in the library assimp/code/AssetLib/BVH/BVHLoader.cpp. The manipulation of the argument pNode leads to use after free. Attacking...

CVE-2025-40916 Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha text

Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand function for generating the captcha text as well as image noise, which is insecure...

CVE-2025-4748

CVE-2025-4748 – Erlang/OTP path traversal in stdlib zip handling : The issue arises from path restriction flaws in lib/stdlib/src/zip.erl, affecting OTP 17.0 up to 28.0.1 (including OTP 27.3.4.1 and 26.2.5.13) and corresponding stdlib 2.0–7.0.1, 6.2.2.1, 5.2.3.4. It enables absolute path traversa...

CVE-2025-47869 Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size.

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability was discovered in Apache NuttX RTOS apps/exapmles/xmlrpc application. In this example application device stats structure that stored remotely provided parameters had hardcoded buffer size which could lead to...

CVE-2025-47869

CVE-2025-47869 affects Apache NuttX RTOS, specifically the apps/examples/xmlrpc component. A device stats structure stored remotely provided parameters using hardcoded buffers can lead to a buffer overflow. The buffers were corrected to CONFIG_XMLRPC_STRINGSIZE+1 in the release 12.9.0 example, af...

CVE-2025-47868

The CVE concerns Apache NuttX’s optional tools/bdf-converter in the repository, which suffers an out-of-bounds write that can cause a heap-based buffer overflow. Affected versions are 6.9 through 12.9.0; the issue arises when the tool is exposed to externally provided data. The advisory recommend...

CVE-2025-6117 Das Parking Management System 停车场管理系统 API Search sql injection

A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been declared as critical. This vulnerability affects unknown code of the file /Reservations/Search of the component API. The manipulation of the argument Value leads to sql injection. The attack can be initiated...

CVE-2025-6115 D-Link DIR-619L form_macfilter stack-based overflow

A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this issue is the function formmacfilter. The manipulation of the argument machostname%d/schedname%d leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclos...