CVE-2025-27020

Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0...

CVE-2025-27020 Improper configuration of SSH service in Infinera MTC-9

Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0...

CVE-2025-27020 Improper configuration of SSH service in Infinera MTC-9

Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0...

Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform

Splunk has fixed vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. The vulnerabilities include several issues, including the ability for low-privileged users to create unauthorized dashboards, access sensitive information via mobile notifications, and the injection of ANSI escape...

CVE-2025-27020: Missing Authentication for Critical Function

Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0...

PT-2025-49582

Name of the Vulnerable Software and Affected Versions UsbDataAdvancedProtectionHook.java affected versions not specified Description A race condition exists in multiple locations within UsbDataAdvancedProtectionHook.java that may allow access to USB data even when the screen is off. Successful...

RockyLinux 8 : webkit2gtk3 (RLSA-2025:17802)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:17802 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-43272 webkitgtk: Processing maliciously crafted we...

The vulnerability of iOS and iPadOS operating systems, related to incorrect default permissions, allows attackers to gain access to protected information.

The vulnerability of iOS and iPadOS operating systems is related to incorrect default permissions. Exploiting this vulnerability can allow attackers to access protected information by circumventing screen lock security restrictions...

Google Apigee-X 安全漏洞

Google Apigee-X is a next-generation API management platform from Google Inc USA. A security vulnerability exists in Google Apigee-X that stems from improper authorization and could lead to unauthorized data access...

The vulnerability of the Knomary TMS training platform, related to deficiencies in authentication procedures, allows unauthorized users to elevate their privileges and gain unauthorized access to protected information.

The vulnerability of the Knomary TMS training platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to increase their privileges and gain unauthorized access to protected information...

The vulnerability of the Mattermost instant messaging application, related to deficiencies in authentication procedures, allows a hacker to gain read, edit, and delete access to data.

The vulnerability of the Mattermost instant messaging application is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain read, edit, and delete privileges...

The vulnerability of the `usb_parse_ss_endpoint_companion()` function in the drivers/usb/core/config.c file of the Linux kernel allows a attacker to compromise the confidentiality and accessibility of protected information.

The vulnerability of the usbparsessendpointcompanion function in the drivers/usb/core/config.c file of the Linux kernel lies in the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality and accessibility of the...

WordPress plugin Feedback Modal for Website 安全漏洞

...

CVE-2025-13932

CVE-2025-13932 concerns the SolisCloud API, where an Insecure Direct Object Reference (IDOR) allows any authenticated user to view detailed data of any plant by changing the plant_id in the request. The issue is described consistently across Red Hat, NVD, CVE lists, EUVD, and related advisories, ...

CVE-2025-57212

Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request...

PT-2025-49148

Name of the Vulnerable Software and Affected Versions DCIM dcTrack affected versions not specified Description An authenticated user with access to the appliance's virtual console could misuse certain remote access features to redirect network traffic. This could potentially allow access to...

CVE-2025-57210

CVE-2025-57210 affects platform v1.0.0 due to incorrect access control in the ApiPayController.java component. The Red Hat/CNNVD/NVD-family entries corroborate a vulnerability allowing access to sensitive information via unspecified vectors. The NVD/CVE metrics indicate a high-severity issue (CVS...

CVE-2025-13606

The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.19. This is due to missing or incorrect nonce validation on the parseData function. This makes it possible for unauthenticated attackers...

CVE-2025-65841

Aquarius Desktop 3.0.069 for macOS stores user authentication credentials in the local file /Library/Application Support/Aquarius/aquarius.settings using a weak obfuscation scheme. The password is "encrypted" through predictable byte-substitution that can be trivially reversed, allowing immediate...

CVE-2025-65841

Aquarius Desktop 3.0.069 for macOS stores user authentication credentials in the local file /Library/Application Support/Aquarius/aquarius.settings using a weak obfuscation scheme. The password is "encrypted" through predictable byte-substitution that can be trivially reversed, allowing immediate...