CVE-2025-50151

File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload...

CVE-2025-50151

File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload...

CVE-2025-50151 Apache Jena: Configuration files uploaded by administrative users are not check properly

File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload...

CVE-2025-44653

In H3C GR2200 MiniGR1A0V100R016, the USERLIMITGLOBAL option is set to 0 in the /etc/bftpd.conf. This can cause DoS attacks when unlimited users are connected...

VulnCheck KEV: CVE-2023-5683

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btnfilerenew leads to os command injection. The attack may be initiated...

CVE-2025-44651

In TRENDnet TPL-430AP FW1.0, the USERLIMITGLOBAL option is set to 0 in the bftpd-related configuration file. This can cause DoS attacks when unlimited users are connected...

PT-2025-30316 · H3C · H3C Gr2200 Minigr1A0V100R016

Name of the Vulnerable Software and Affected Versions: H3C GR2200 MiniGR1A0V100R016 Description: The USERLIMIT GLOBAL option is set to 0 in the /etc/bftpd.conf file. This configuration can lead to denial-of-service DoS attacks due to the possibility of unlimited user connections. Recommendations:...

CVE-2025-44651

In TRENDnet TPL-430AP FW1.0, the USERLIMITGLOBAL option is set to 0 in the bftpd-related configuration file. This can cause DoS attacks when unlimited users are connected...

CVE-2025-0664: Improper Control of Generation of Code

A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrary local library. This may impair endpoint defenses and allow the attacker to achieve code execution with SYSTEM-level privileges...

CVE-2025-44649

The TRENDnet TEW-WLC100P (version 2.03b03 ) is vulnerable due to a misconfiguration in the racoon configuration file where the exchage_mode is set to aggressive . This setting in IKE Phase 1 exposes identity information in plaintext , making the system susceptible to offline dictionary attacks an...

CVE-2024-10031

In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system...

CVE-2025-32353

Kaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials for privileged access stored in the collector.txt configuration file...

CVE-2025-6231

Technical details about CVE-2025-6231 are not publicly provided in the connected documents. Monitor for updates; no concrete exploit, affected versions, or fixes are described here.

CVE-2025-6265

A path traversal vulnerability in the fileupload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10ACGE.2 and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device...

CVE-2025-6231: Improper Neutralization of Argument Delimiters in a Command

An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying an application configuration file...

CVE-2025-32353

Kaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials for privileged access stored in the collector.txt configuration file...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via modifications to the configuration file in the underlying operating system. An attacker can execute arbitrary scripts in the context of the affected application by injecting malicious content into the...

Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications

In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system...

GHSA-HP97-5X6G-Q538 Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications

In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system...

CVE-2024-10031

In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system...