CVE-2025-54253 Adobe Experience Manager | Incorrect Authorization (CWE-863)

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user...

Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information

Vulnerability Details Affected Vendor: Xorux Affected Product: XorMon-NG Affected Version: 1.8 and prior Platform: Debian CWE Classification: CWE-648: Incorrect Use of Privileged APIs CVE ID: CVE-2025-54766 2. Vulnerability Description An API endpoint that should be limited to web application...

Xorux XorMon-NG Web Application Privilege Escalation to Administrator

Vulnerability Details Affected Vendor: Xorux Affected Product: XorMon-NG Affected Version: 1.8 and prior Platform: Debian CWE Classification: CWE-648: Incorrect Use of Privileged APIs CVE ID: CVE-2025-54765 2. Vulnerability Description An API endpoint that should be limited to web application...

Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by CVE-2024-38434

Summary IBM Engineering Systems Design Rhapsody was vulnerable to use of Potentially Dangerous Function which may allow security feature bypass Vulnerability Details CVEID:CVE-2024-38434 DESCRIPTION: Unitronics Vision PLC – CWE-676: Use of Potentially Dangerous Function may allow security feature...

CVE-2025-46384

CWE-434 Unrestricted Upload of File with Dangerous Type...

"region PAY" App for Android vulnerable to insertion of sensitive information into log file

Overview "region PAY" App for Android provided by Gift Pad Co.,Ltd. contains the following vulnerability. Insertion of sensitive information into log file CWE-532 - CVE-2025-52580 Kubo Naoki reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

CVE-2025-46384

CWE-434 Unrestricted Upload of File with Dangerous Type...

CVE-2025-46384

CWE-434 Unrestricted Upload of File with Dangerous Type...

CVE-2024-32124

An improper access control vulnerability CWE-284 in FortiIsolator version 2.4.4, version 2.4.3, 2.3 all versions logging component may allow a remote authenticated read-only attacker to alter logs via a crafted HTTP request...

CVE-2025-50124

A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account via a console and through exploitation of a setup script...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

CVE-2025-50122

A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artifacts...

CVE-2025-50124

A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account via a console and through exploitation of a setup script...

CVE-2025-6788

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providing other authenticated users with potentially inappropriate access to TGML diagrams...

CVE-2025-50124

A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account via a console and through exploitation of a setup script...

CVE-2025-50124

CVE-2025-50124 affects Schneider Electric EcoStruxure IT Data Center Expert (DCE) prior to version 9.0 (8.3 and earlier). The vulnerability stems from a Charon executable/configuration that can be abused by a low-privileged attacker to gain root privileges, enabling privilege escalation via local...

CVE-2025-50122

A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artifacts...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

CVE-2025-6438

Schneider Electric EcoStruxure IT Data Center Expert (prior to 9.0; affected versions 8.3 and earlier) is affected by CVE-2025-6438: XML External Entity (XXE) injection via the DataExchange SOAP route, enabling unauthenticated or low-privilege exploitation to read local files and potentially caus...

PT-2025-29227 · Apache · Apache Tgml

Name of the Vulnerable Software and Affected Versions: Apache TGML versions affected versions not specified Description: A CWE-668: Exposure of Resource to Wrong Sphere issue exists, exposing TGML diagram resources to an incorrect control sphere. This allows other authenticated users to potential...