Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS before 18.4 and Apple iPadOS before 18.4, which stems from vulnerable code th...

Docker Desktop 安全漏洞

Docker Desktop is a desktop software for lightweight deployment of applications based on container technology from Docker Inc. in the United States. The product provides a desktop environment that supports creating a container lightweight virtual machine and deploying and running applications on...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in versions of Mozilla Firefox prior to 138, which stems from an attacker's ability to disclose sensitive information or elevate privileges using a privileged UITour act...

eCommerce-website-in-PHP 安全漏洞

eCommerce-website-in-PHP is a free and open source php e-commerce platform by scriptandtools individual developers. A security vulnerability exists in eCommerce-website-in-PHP version 3.0, which originates from an incorrect operation of the file /admin/subscriber-csv.php that results in informati...

HCL SX 加密问题漏洞

HCL SX is an application from HCL India. A security vulnerability exists in HCL SX version v21, which stems from the use of weak encryption algorithms and could lead to the disclosure of sensitive information or data tampering...

PT-2025-10: Server-Side Request Forgery (SSRF) in HTML2PDF

The application performs insufficient validation of the destination address before sending an HTTP request. The vulnerability exploitation leads to the disclosure of sensitive data, denial of service, and etc. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 25.04.2025...

The vulnerability of the Telnet service of the TOTOLINK A810R router’s microprogramming system allows a intruder to disclose protected information.

The vulnerability of the Telnet service in the microprogramming software of TOTOLINK A810R routers is related to the use of strictly encrypted login credentials. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

The vulnerability of the integrated development environment for software, JetBrains RubyMine, arises from insecure resource initialization, allowing attackers to exploit it to disclose protected information.

The vulnerability of the integrated development environment for software, JetBrains RubyMine, is related to the insecure initialization of resources. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

USN-7446-1 libapache2-mod-auth-openidc vulnerability

It was discovered that modauthopenidc incorrectly handled certain POST requests. An attacker could possibly use this issue to obtain sensitive information...

The vulnerability of the SAP Commerce Cloud platform, related to the transmission of critical information in open text, allows attackers to disclose protected information.

The vulnerability of the SAP Commerce Cloud e-commerce platform lies in the transmission of critical information in plaintext. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

The vulnerability of the /boafrm/formStaticDHCP file of the Authorization Interface component in D-Link DWR-M961 microprogrammed router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the /boafrm/formStaticDHCP file of the Authorization Interface component in D-Link DWR-M961 routers’ microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

PostHog 代码问题漏洞

PostHog is an all-in-one open source platform from PostHog Open Source. A code issue vulnerability exists in PostHog that stems from the lack of validation of the URI when the slackincomingwebhook parameter is processed, which could lead to server-side request forgery and information disclosure...

Rockwell Automation Arena Local Code Execution Vulnerability

Rockwell Automation Arena is a discrete-event simulation and automation software from Rockwell Automation USA. A local code execution vulnerability exists in Rockwell Automation Arena due to improper validation of user-supplied data. An attacker could exploit the vulnerability to disclose...

Rockwell Automation Arena Local Code Execution Vulnerability (CNVD-2025-21437)

Rockwell Automation Arena is a discrete-event simulation and automation software from Rockwell Automation USA. A local code execution vulnerability exists in Rockwell Automation Arena due to improper validation of user-supplied data. An attacker could exploit the vulnerability to disclose...

CVE-2025-26478

Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure...

The vulnerability of the sg_release() function in the drivers/scsi/sg.c module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sgrelease function in the drivers/scsi/sg.c module of the Linux kernel is related to the reutilization of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

CVE-2025-2830

By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the...

Security Bulletin: Multiple Vulnerabilities in IBM Datacap

Summary Multiple vulnerabilities were addressed in IBM Datacap version 9.1.9 Interim Fix 005 Vulnerability Details CVEID:CVE-2024-39734 DESCRIPTION: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers...

Vulnerability of the smu_v13_0_update_pcie_parameters() function in the drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c module – This driver supports AMD graphics card Direct Rendering Infrastructure (DRI) in Linux operating systems. It can be exploited by attackers to compromise the confidentiality, integrity, and accessibility of protected information.

Vulnerability of the smuv130updatepcieparameters function in the drivers/gpu/drm/amd/pm/swsmu/smu13/smuv130.c module – The driver that supports Direct Rendering Infrastructure DRI for AMD graphics cards in Linux operating systems has a unvalidated array indexing issue. Exploiting this vulnerabili...

Oracle Database Server 安全漏洞

Oracle Database Server is a relational database management system from Oracle Corporation USA. This database management system provides data management, distributed processing, and other functions. A security vulnerability exists in Fleet Patching and Provisioning versions 19.3 through 19.26 of...