SAMSUNG Smart Switch 安全漏洞

Samsung Smart Switch is a data migration tool developed by South Korea’s Samsung Corporation. Versions of Samsung Smart Switch prior to 3.7.69.15 contained security vulnerabilities. These vulnerabilities stemmed from exposing sensitive functions to unauthorized participants, potentially allowing...

Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)

The MyList configuration feature in Admidio allows authenticated users to define custom list column layouts. User-supplied column names, sort directions, and filter conditions are stored in the admlistcolumns table via prepared statements safe storage, but are later read back and interpolated...

Serviio PRO 访问控制错误漏洞

Serviio PRO is a multimedia streaming server software developed by the British company Serviio. Version 1.8 of Serviio PRO contains a vulnerability related to access control. This vulnerability stems from improper access control settings in the Configuration REST API, which may allow...

(Pwn2Own) QNAP TS-453E Hyper Data Protector Plugin Hard-Coded Credentials Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of QNAP TS-453E devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of Bareos by the Hyper Data Protector Plugin. The issue...

PT-2026-25735

Serviio PRO 1.8 contains an information disclosure vulnerability due to improper access control enforcement in the Configuration REST API that allows unauthenticated attackers to access sensitive information. Remote attackers can send specially crafted requests to the REST API endpoints to retrie...

Mattermost Plugins 安全漏洞

Mattermost Plugins is a plugin provided by the American company Mattermost, offering powerful feature extensions and tight integration with servers and network/desktop applications. Versions of Mattermost Plugins 2.0.3.0 and earlier contain security vulnerabilities. These vulnerabilities stem fro...

EulerOS 2.0 SP12 : dhcp (EulerOS-SA-2026-1387)

According to the versions of the dhcp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This...

BabyChakra Pregnancy & Parenting App 安全漏洞

The BabyChakra Pregnancy & Parenting App is a pregnancy and parenting service app developed by the Indian company BabyChakra. The BabyChakra Pregnancy & Parenting App versions 5.4.3.0 and earlier contained security vulnerabilities. These vulnerabilities were caused by improper handling of the...

PT-2026-25600

Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration...

Tenda AC8 操作系统命令注入漏洞

The Tenda AC8 is a wireless router produced by the Chinese company Tenda. The version 16.03.50.11 of the Tenda AC8 has a vulnerability related to operating system command injection. This vulnerability stems from incorrect handling of the parameter “wans.policy.list1” in the /cgi-bin/UploadCfg fil...

TP-LINK多款产品 安全漏洞

TP-LINK TL-WR802N, etc., are products of the TP-LINK company from China. The TP-LINK TL-WR802N is a wireless router. The TP-LINK TL-WR840N is also a wireless router. The TP-LINK TL-WR841N is another product of TP-LINK. Several TP-LINK products have security vulnerabilities; these vulnerabilities...

AnythingLLM 跨站脚本漏洞

AnythingLLM is an integrated AI application open source by Mintplex. Versions of AnythingLLM 1.11.1 and earlier contained a cross-site scripting vulnerability. This vulnerability stemmed from the presence of a streaming-phase cross-site script in the chat rendering pipeline. Due to insecure...

iccDEV Buffer Overflow Vulnerability

iccDEV is a color configuration code base. A buffer overflow vulnerability exists in iccDEV that can be exploited by an attacker to cause a memory leak or crash...

CVE-2017-20220 Serviio PRO 1.8 Unauthenticated Password Change via REST API

Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password. Attackers can send specially crafted requests to the REST API endpoints to modify credentials without authentication...

CVE-2017-20220

Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password. Attackers can send specially crafted requests to the REST API endpoints to modify credentials without authentication...

CVE-2017-20220 Serviio PRO 1.8 Unauthenticated Password Change via REST API

Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password. Attackers can send specially crafted requests to the REST API endpoints to modify credentials without authentication...

CVE-2017-20220

CVE-2017-20220 affects Serviio PRO 1.8. The vulnerability is an improper access control in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password by sending crafted requests to REST endpoints. The available documents confirm the affected product...

CVE-2017-20217

CVE-2017-20217 affects Serviio PRO 1.8 and related builds via an information-disclosure vulnerability in the Configuration REST API. The root cause is improper access-control enforcement, allowing unauthenticated remote attackers to send crafted REST requests and retrieve sensitive configuration ...

CVE-2017-20217 Serviio PRO 1.8 REST API Information Disclosure

Serviio PRO 1.8 contains an information disclosure vulnerability due to improper access control enforcement in the Configuration REST API that allows unauthenticated attackers to access sensitive information. Remote attackers can send specially crafted requests to the REST API endpoints to retrie...

CVE-2017-20217 Serviio PRO 1.8 REST API Information Disclosure

Serviio PRO 1.8 contains an information disclosure vulnerability due to improper access control enforcement in the Configuration REST API that allows unauthenticated attackers to access sensitive information. Remote attackers can send specially crafted requests to the REST API endpoints to retrie...