23603 matches found
CVE-2025-39592 WordPress Subscribe to Unlock Lite plugin <= 1.3.0 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Shuffle Subscribe to Unlock Lite subscribe-to-unlock-lite allows PHP Local File Inclusion.This issue affects Subscribe to Unlock Lite: from n/a through = 1.3.0...
CVE-2025-1982
CVE-2025-1982 is a Local File Inclusion vulnerability in Ready’s attachment upload panel. The Red Hat CVE-2025-1982 entry confirms a low-privilege user can exploit a file:// link to read local system files, indicating a confidentiality impact. Connected RH entries also describe a related CVE-2025...
CVE-2025-22021
In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nfsklookupslowv4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket if any. Then socketmatch can...
CVE-2024-58092
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization Get rid of the nfsd4legacytrackingops-init call in checkforlegacymethods. That will be handled in the caller nfsd4clienttrackinginit. Otherwise, we'll wind up calling...
CVE-2025-30960
Missing Authorization vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through = 6.5.8...
CVE-2025-22020
In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: Fix slab-use-after-free in rtsxusbmsdrvremove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsxusbmspollcard+0x159/0x20...
CVE-2024-58092
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization Get rid of the nfsd4legacytrackingops-init call in checkforlegacymethods. That will be handled in the caller nfsd4clienttrackinginit. Otherwise, we'll wind up calling...
CVE-2025-22023
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Don't skip on Stopped - Length Invalid Up until commit d56b0b2ab142 "usb: xhci: ensure skipped isoc TDs are returned when isoc ring is stopped" in v6.11, the driver didn't skip missed isochronous TDs when handling...
CVE-2025-22021 netfilter: socket: Lookup orig tuple for IPv6 SNAT
In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nfsklookupslowv4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket if any. Then socketmatch can...
CVE-2025-22020 memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: Fix slab-use-after-free in rtsxusbmsdrvremove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsxusbmspollcard+0x159/0x20...
CVE-2025-3681 PCMan FTP Server MODE Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MODE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public...
CVE-2025-31363
Mattermost CVE-2025-31363 affects Mattermost Server in versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, and 9.11.x
CVE-2025-30691
Vulnerability in Oracle Java SE component: Compiler. Supported versions that are affected are Oracle Java SE: 21.0.6, 24; Oracle GraalVM for JDK: 21.0.6 and 24. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java...
CVE-2025-32093
Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system...
CVE-2025-27538
Mattermost versions 10.5.x = 10.5.1, 9.11.x = 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with editotherusers permission to activate or deactivate MFA for other users, even if those users have not...
CVE-2025-27571
CVE-2025-27571 affects Mattermost Server versions 9.11.x <= 9.11.9, 10.4.x <= 10.4.3, and 10.5.x
CVE-2022-46945
creationtimestamp| type| source ---|---|--- 2025-04-16 06:53:31+00:00| seen| https://bsky.app/profile/nimblenerd.social/post/3lmvyz4qv322j 2025-04-17 21:02:30+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lmzyvyf7du2a...
CVE-2024-55211
creationtimestamp| type| source ---|---|--- 2025-04-16 05:00:06+00:00| published-proof-of-concept| Telegram/mQBAnIB4wxCayakdSJg64fJulzrdejim5tVILr8NLm8g 2025-04-17 17:57:27+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12295 2025-04-17 18:54:26+00:00| seen|...
CVE-2025-3668 TOTOLINK A3700R cstecgi.cgi setScheduleCfg access control
A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been declared as critical. This vulnerability affects the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has...
CVE-2025-3666
CVE-2025-3666 affects TOTOLINK A3700R (v9.1.2u.5822_B20200513). The vulnerability is in the setDdnsCfg function of /cgi-bin/cstecgi.cgi, causing improper access controls. Exploitation may be remote and public disclosures exist. Vendor did not respond. A practical workaround from PT-Security sugge...