CVE-2025-1051 Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability

Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2025-5389

A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogenerateOne2Many of the file /generateController.do?dogenerateOne2Many of the component File Handler. The manipulation leads to improper access controls. The attack...

CVE-2025-20298

creationtimestamp| type| source ---|---|--- 2025-06-02 17:41:53+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqnd3uxys5d2 2025-06-02 18:00:20+00:00| seen| Telegram/toim9KAGesCTq5oqOj-obWHkIDyEkDrySjdW6f3o1ChokI 2025-06-03 12:41:15+00:0...

CVE-2025-20297

creationtimestamp| type| source ---|---|--- 2025-06-02 17:41:52+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqnd3v5drai2 2025-06-03 16:57:27+00:00| seen| https://bsky.app/profile/thedailytechfeed.com/post/3lqpr565vx22s 2025-06-03...

CVE-2025-48940

creationtimestamp| type| source ---|---|--- 2025-06-02 17:01:55+00:00| published-proof-of-concept| Telegram/evyU1N0NEzlqWkLQZaMrYM3OKb94J6CqLDhasOVakxq7P0 2025-06-02 17:08:39+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqnbbbz2jft2...

CVE-2024-7074 Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server. By leveraging this vulnerability, an...

CVE-2025-48995 SignXML's signature verification with HMAC is vulnerable to a timing attack

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2024-40113

creationtimestamp| type| source ---|---|--- 2025-06-02 16:00:05+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqn5eyrjl3s2...

CVE-2025-48866

creationtimestamp| type| source ---|---|--- 2025-06-02 15:59:42+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqn5ek2bvny2 2025-06-02 16:45:31+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114614778635202833 2025-06-02...

CVE-2025-44172

creationtimestamp| type| source ---|---|--- 2025-06-02 15:59:41+00:00| seen| https://bsky.app/profile/FunctionalProgramming.activitypub.awakari.com.ap.brid.gy/post/3lqn5efgro7s2 2025-06-02 17:47:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqndilrkyo2s...

CVE-2025-48941 MyBB may disclosure unviewable threads' titles in searches

MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden draft, unapproved, or soft-deleted threads containing specified text in the title. The visibility state...

CVE-2024-54028

creationtimestamp| type| source ---|---|--- 2025-06-02 15:30:17+00:00| seen| https://infosec.place/objects/8bfd0e8e-69da-4ffa-a585-5c7e8302e236 2025-06-02 15:59:41+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqn5eks6lds2 2025-06-02...

CVE-2024-54028

An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2025-47289

creationtimestamp| type| source ---|---|--- 2025-06-02 14:52:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqmzpeqwn42s...

CVE-2025-5442

creationtimestamp| type| source ---|---|--- 2025-06-02 14:42:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqmz5hi5ly2a...

CVE-2025-37091

A command injection remote code execution vulnerability exists in HPE StoreOnce Software...

CVE-2025-46806

creationtimestamp| type| source ---|---|--- 2025-06-02 13:28:46+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqmusy63kia2 2025-06-13 12:32:14+00:00| seen| https://seclists.org/oss-sec/2025/q2/248 2025-06-13 14:55:57+00:00| seen|...

CVE-2025-48955

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require...

CVE-2025-5444

CVE-2025-5444 affects Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 (firmware 1.0.013.001–1.2.07.001). The vulnerability is in the function RP_UpgradeFWByBBS in /goform/RP_UpgradeFWByBBS, where manipulation of the argument type/ch/ssidhex/security/extch/pwd/mode/ip/nm/gw leads to OS command i...

CVE-2025-48990

NeKernal (version 0.0.2) has a 1-byte heap overflow in rt_copy_memory that writes a null terminator to dst[len]. When len equals the destination buffer size (256 bytes), this extra write overruns the buffer by one byte. The patch in commit fb7b7f658327f659c6a6da1af151cb389c2ca4ee removes the over...