CVE-2025-1299 Missing Authorization in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versions starting from 18.2 before 18.2.1 that, under circumstances, could have allowed an unauthorized user to read deployment job logs by...

Ivanti Policy Secure 安全漏洞

Ivanti Policy Secure IPS is a network access control NAC solution from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Policy Secure IPS versions prior to 22.6R1 that originates from an authenticated administrator being able to perform arbitrary file reads via a specially craft...

The vulnerability of the Device Admin App on the ctrlX OS operating system allows a perpetrator to compromise the integrity of the vulnerable application’s configuration.

The vulnerability of the Device Admin App on the ctrlX OS lies in the improper validation of the data entered by the user against a list of allowed values. Exploiting this vulnerability allows an attacker to compromise the integrity of the vulnerable application by sending a specially crafted HTT...

Ivanti Endpoint Manager 安全漏洞

Ivanti Endpoint Manager is a comprehensive endpoint management solution developed by Ivanti to manage all endpoint devices in an enterprise network. Ivanti Endpoint Manager suffers from a cryptographic misuse vulnerability that stems from an incorrect cryptographic implementation, which can be...

The vulnerability of the Segnetics SMConfig system configuration tool, which stems from the use of pre-installed credentials, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Segnetics SMConfig system configuration tool is related to the use of pre-installed credentials. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information by sending a specially...

Arbitrary Code Injection

Overview bolt/bolt is a sophisticated, lightweight & simple CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the function modify in the Users.php file. An attacker with valid credentials can execute arbitrary PHP code by injecting malicious input into the...

The vulnerability of the OCAS Assistant dialog system, related to improper code generation management, allows a perpetrator to execute arbitrary code.

The vulnerability of the OCAS Assistant dialog system is related to improper handling of code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted POST request...

The vulnerability of the online business analytics service IBM Cognos Analytics, related to unlimited resource distribution, allows a perpetrator to cause a service failure.

The vulnerability of the online business analytics service IBM Cognos Analytics lies in its unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending a specially crafted request...

The vulnerability of Hikvision’s IP cameras’ microprogramming software lies in the fact that the operation value escapes the buffer in memory when processing the PrivateKey parameter. This allows a intruder to trigger a service failure.

The vulnerability of Hikvision’s IP cameras’ microprogramming software is related to the issue where the operation data escapes from the buffer into memory when processing the PrivateKey parameter. Exploiting this vulnerability can allow a remote attacker to cause a service failure by sending a...

The vulnerability of the formRoute() function in the TOTOLINK A3002R router’s software allows a hacker to execute arbitrary code.

The vulnerability of the formRoute function in the TOTOLINK A3002R router’s microprogramming system lies in the reading of data beyond the buffer boundaries in memory during the processing of the subnet parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by...

Dnn.Platform 跨站脚本漏洞

Dnn.Platform is an open source web content management platform CMS open sourced by Dnn Software. A cross-site scripting vulnerability exists in Dnn.Platform versions prior to 10.0.1, which stems from a specially crafted request injection script that could lead to a cross-site scripting attack...

The vulnerability of the httpGetEnv() function in TP-Link TL-WR940N router software allows a hacker to cause a service failure.

The vulnerability of the httpGetEnv function in TP-Link TL-WR940N router software lies in the fact that the operation is executed outside the buffer in memory when processing the dnsserver1 parameter. Exploiting this vulnerability allows a malicious actor to cause service failure by sending a...

The vulnerability of the “Termide Virtual Desktops Connection Manager” software server arises from an improper limitation on the path name to the restricted access catalog, allowing a perpetrator to gain access to any file in the file system.

The vulnerability of the “Termide Virtual Desktops Connection Manager” software complex is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to any file in the file system by...

CVE-2025-25032

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of service by sending a specially crafted request that would exhaust memory resources...

The vulnerability of the built-in web server boa (/boafrm/formDMZ) of TOTOLINK EX1200T router’s microprogramming software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the built-in web server boa /boafrm/formDMZ of TOTOLINK EX1200T routers is caused by buffer overflow. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information by sending a specially crafted...

Google Chrome 安全漏洞

Google Chrome is a popular web browser. Google Chrome suffers from a type obfuscation vulnerability that originates from accessing a resource using an incompatible type, which can be exploited by a remote attacker to submit a special WEB request that can be tricked into being parsed by the user,...

VulnCheck KEV: CVE-2024-46982

Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router this does not affect the app router. When this crafted request is sent it could coerce...

CVE-2025-32106

In Audiocodes Mediapack MP-11x through 6.60A.369.002, a crafted POST request request may result in an unauthenticated remote user's ability to execute unauthorized code...

CVE-2025-32106

In Audiocodes Mediapack MP-11x through 6.60A.369.002, a crafted POST request request may result in an unauthenticated remote user's ability to execute unauthorized code...

CVE-2025-45529

An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET request to /cms/templates/templatesAssetsEditor...