25197 matches found
EUVD-2025-200280
arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints...
Insecure Default Initialization of Resource
Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Insecure Default Initialization of Resource for the DNS rebinding protection that is not enabled by default for HTTP-based servers running on localhost without authentication using FastMCP. An attacke...
CVE-2025-20085
A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to denial of service and weaken credentials resulting in default documented credentials being applied to the device. An attacker can...
CVE-2024-49572
A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to denial of service and weaken credentials resulting in default documented credentials being applied to the device. An attacker can send an...
CVE-2025-41744
Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity...
CVE-2025-41742
Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance...
CVE-2025-41742
The CVE-2025-41742 entry concerns Sprecher Automations SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3. Affected components are the system’s cryptographic keys, with a root cause described as the use of default cryptographic keys that can be exploited by an unauthorized remote attacker. Consequences s...
EUVD-2025-200220
Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance...
CVE-2025-41742 Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components
Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance...
EUVD-2025-200222
Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity...
CVE-2025-41744 Sprecher Automation: SPRECON-E series has static default key material for TLS connections
Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity...
CVE-2025-41744
CVE-2025-41744 affects Sprecher Automation SPRECON-E series devices. Connected exploits confirm use of a default symmetric AES-256 key embedded across firmware, enabling unauthenticated remote attackers to decrypt and potentially tamper with encrypted network traffic. Impact is confidentiality an...
CVE-2025-41744 Sprecher Automation: SPRECON-E series has static default key material for TLS connections
Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity...
shadow-utils security update
An update is available for shadow-utils. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The shadow-utils packages include programs for converting UNIX password...
RLSA-2025:20145 Low: shadow-utils security update
The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fixes: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2024-56433 For...
Incorrect Default Permissions
Overview bzfs is a bzfs is a reliable near real-time, parallel replication and backup command-line tool for ZFS. It replicates snapshots from many local or remote source ZFS datasets and their descendants to local or remote destination datasets, using zfs send/receive and ssh, and can operate at...
Denial Of Service (DoS)
org.keycloak, keycloak-quarkus-dist is vulnerable to a Denial of Service DoS. The vulnerability is due to the default JDK setting that permits client-initiated TLS 1.2 renegotiation, which allows an attacker to repeatedly trigger renegotiation requests to exhaust server CPU resources...
CVE-2025-58484
Incorrect default permissions in Samsung Cloud Assistant prior to version 8.0.03.8 allows local attacker to access partial data in sandbox...