CVE-2025-49177 Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests...

CVE-2025-49177 Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests...

CVE-2025-49177

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests...

CVE-2025-49176 Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension

A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check...

CVE-2025-4754

creationtimestamp| type| source ---|---|--- 2025-06-17 14:39:56+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18591 2025-06-17 16:16:40+00:00| seen| https://bsky.app/profile/theerlef.bsky.social/post/3lrsvf54jx227 2025-06-17 18:03:24+00:00| seen|...

CVE-2025-4404

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

CVE-2025-34508 ZendTo < 6.15-8 Path Traversal

A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo users, retrieve files on the host system, or cause a denial of service...

CVE-2025-5349

creationtimestamp| type| source ---|---|--- 2025-06-17 13:39:42+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18589 2025-06-17 15:56:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrsuayuxxd2o 2025-06-18 03:21:53+00:00| seen|...

CVE-2025-5349

Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway...

CVE-2025-6020

A flaw was found in linux-pam. The module pamnamespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions...

WordPress Master Slider plugin <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide Shortcodes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via mastersliderpb and msslide Shortcodes vulnerability discovered by muhammad yudha in WordPress Plugin Master Slider versions = 3.10.8...

CVE-2025-3880 Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update

The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with...

CVE-2025-6020

creationtimestamp| type| source ---|---|--- 2025-06-17 11:22:14+00:00| seen| https://seclists.org/oss-sec/2025/q2/258 2025-06-17 13:36:33+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3lrsmgvbqim2g 2025-06-17 13:39:34+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18584...

WordPress YITH WooCommerce Wishlist plugin <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin YITH WooCommerce Wishlist versions = 4.5.0...

CVE-2025-40674 Reflected Cross-Site Scripting (XSS) in osCommerce

Reflected Cross-Site Scripting XSS in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user...

CVE-2025-6165

The CVE-2025-6165 entry affects TOTOLINK X15, version 1.0.0-B20230714.1105, specifically the HTTP POST Request Handler component and the /boafrm/formTmultiAP endpoint. The root cause is improper validation of the submit-url parameter, causing a buffer overflow that can be triggered remotely. Publ...

CVE-2025-5209 Ivory Search < 5.5.10 - Admin+ Stored XSS

The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2025-6163

A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The...

CVE-2025-6163 TOTOLINK A3002RU HTTP POST Request formMultiAP buffer overflow

A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The...

CVE-2025-6162

CVE-2025-6162 affects TOTOLINK EX1200T (4.1.2cu.5232_B20210713). The vulnerability exists in the HTTP POST Request Handler’s file path /boafrm/formMultiAP, where manipulating the submit-url argument causes a buffer overflow. This can be exploited remotely and is described as a high-severity issue...