6722 matches found
CVE-2025-1259 On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.
On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in users retrieving data that should not have been available...
CVE-2025-27402
CVE-2025-27402 affects Tuleap, an open-source software lifecycle and collaboration suite. The vulnerability is a missing CSRF protection on tracker fields administrative operations, enabling an attacker to trick victims into removing or updating tracker fields. Affected code and impact are descri...
CVE-2025-1938
creationtimestamp| type| source ---|---|--- 2025-03-04 15:50:48+00:00| seen| https://t.me/cvedetector/19506 2025-03-04 17:14:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ljkxogmk3u2y...
CVE-2025-1933
creationtimestamp| type| source ---|---|--- 2025-03-04 15:50:41+00:00| seen| https://t.me/cvedetector/19502 2025-03-04 18:31:35+00:00| seen| Telegram/1O5z91QcHmrjRz26b3O2xs57dQF3nVw-sSDMEN0aU64nGRA 2025-03-07 21:44:44+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3ljsy5uqaqs2...
CVE-2025-1935
A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8...
CVE-2025-1941 Lock screen setting bypass in Firefox Focus for Android
Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed distinct from CVE-2025-0245. This vulnerability was fixed in Firefox 136...
CVE-2025-0359
creationtimestamp| type| source ---|---|--- 2025-03-04 05:30:25+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/6336 2025-03-04 07:01:11+00:00| seen| Telegram/KMaUn6LoquU53d7iffCrOSuKlQToZrYIsgCGQ54aBz77qLY 2025-03-04 07:04:07+00:00| seen|...
CVE-2025-22835
creationtimestamp| type| source ---|---|--- 2025-03-04 04:34:34+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/6329 2025-03-04 04:59:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ljjomg46e52s 2025-03-04 05:48:06+00:00| seen| https://t.me/cvedetector/19...
CVE-2025-1306 Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload
The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunchinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...
CVE-2025-20091
CVE-2025-20091 affects OpenHarmony v5.0.2 and earlier. The issue is a use-after-free in components used by pre-installed apps, enabling local arbitrary code execution in restricted scenarios. NVD notes a HIGH-severity, local exploitable vector with low attack complexity and no user interaction re...
CVE-2025-25426
CVE-2025-25426 affects yshopmall prior to v1.9.0, where a SQL injection vulnerability exists in the image listing interface. The Red Hat advisory and PT-Security entry corroborate that the issue is specifically an SQL injection flaw in versions before 1.9.0, with exploitation tied to the vulnerab...
CVE-2024-51961 Local file inclusion (LFI) vulnerability in ArcGIS Server
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server. Due to the nature of the files...
CVE-2025-1879
CVE-2025-1879 affects i-Drive i11/i12 APK (up to 20250227). Description: hard-coded credentials allow a direct attack on the physical device; maintainer unknown and product appears end-of-life. No explicit exploit/vector details or mitigation are provided in the supplied documents; connected sour...
CVE-2025-25939
Reprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform/activateprocess via the akey parameter...
CVE-2025-1878 i-Drive i11/i12 WiFi default password
A vulnerability has been found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This vulnerability affects unknown code of the component WiFi. The manipulation leads to use of default password. Access to the local network is required for this attack to succeed. The complexity ...
CVE-2025-1889
CVE-2025-1889 involves the Python tool picklescan, where versions before 0.0.22 only consider standard pickle file extensions for scans. An attacker can embed a malicious pickle with a non‑standard extension inside a model or archive, bypassing detection and potentially enabling remote code execu...
CVE-2025-27370
creationtimestamp| type| source ---|---|--- 2025-03-03 18:35:11+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/6246 2025-03-03 19:39:46+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114100193525391284 2025-03-03 21:24:44+00:00| seen|...
CVE-2025-27422
creationtimestamp| type| source ---|---|--- 2025-03-03 17:15:15+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114099625284227660 2025-03-03 19:44:02+00:00| seen| https://t.me/cvedetector/19376...