Advantech WebAccess/VPN 安全漏洞

Advantech WebAccess/VPN is a virtual private network feature integrated in Advantech WebAccess/SCADA software, designed to provide a secure and reliable network connectivity solution for industrial automation and remote monitoring systems. Advantech WebAccess/VPN suffers from a cross-site scripti...

CVE-2025-61956

Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and misleading air traffic control ATC and pilots...

The vulnerability of the Poly Clariti Manager platform for managing, planning, and maintaining audio-visual systems lies in its lack of access control mechanisms, allowing attackers to escalate their privileges.

The vulnerability of the Poly Clariti Manager platform for managing, planning, and maintaining audiovisual systems is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

The vulnerability of the cloud-based corporate solution for planning and managing software and IT projects like Jira Align (formerly AgileCraft) stems from deficiencies in the authorization process, allowing unauthorized users to gain access to protected information.

The vulnerability of the cloud-based corporate solution for planning and managing software and IT projects like Jira Align formerly AgileCraft is related to deficiencies in the authorization process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain...

WordPress plugin MDTF 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

The vulnerability in the implementation of the OAuth protocol for the Mattermost instant messaging application allows a hacker to circumvent existing security restrictions.

The vulnerability of the OAuth implementation for the Mattermost instant messaging application is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions remotely...

AndSoft e-TMS Cross-Site Scripting Vulnerability (CNVD-2025-23558)

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameters l, demo, demo2, TNTLOGIN, UO, and SuppConn in the file...

The vulnerability of the cross-platform hypervisor Xen in Linux operating systems, related to deficiencies in access control, allows attackers to gain access to confidential information.

The vulnerability of the cross-platform hypervisor Xen in Linux operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, working remotely, to gain access to confidential information...

EUVD-2025-32499

An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example...

HCL MyXalytics 安全漏洞

HCL MyXalytics is an analytics software product from HCL India. It is used to perform data analysis and other related tasks. A security vulnerability exists in HCL MyXalytics version 6.6, which stems from a lack of proper validation and access control when automatically binding user inputs to...

CVE-2025-58317

Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process...

The vulnerability of Lenovo Vantage’s software, related to deficiencies in access control, allows attackers to escalate their privileges.

The vulnerability of Lenovo Vantage software is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the command-line interface (CLI) of the software-defined networking management hardware from HPE Aruba Networking EdgeConnect SD-WAN allows a attacker to escalate their privileges and execute arbitrary commands.

The vulnerability of the command-line interface CLI of the software-defined networking management software from HPE Aruba Networking EdgeConnect SD-WAN is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute...

The vulnerability of the cloud platform for creating and deploying intelligent chatbots in Azure Bot Service lies in the lack of access control mechanisms, which allows attackers to escalate their privileges.

The vulnerability of the Azure Bot Service, a cloud platform for creating and deploying intelligent chatbots, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

The vulnerability of the Dynamics 365 FastTrack Implementation software for resource planning in Microsoft Dynamics 365 lies in its lack of access control mechanisms, allowing attackers to exploit it to disclose sensitive information.

The vulnerability of the Dynamics 365 FastTrack Implementation software for resource planning in Microsoft Dynamics 365 is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to disclose sensitive information...

CVE-2025-41058

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/rowmanager...

CVE-2025-41052

CVE-2025-41052 affects appRain CMF 4.0.5. A stored authenticated XSS exists due to insufficient validation of user input in the /apprain/developer/addons/update/canvasjs endpoint, triggered via data[Addon][layouts] and data[Addon][layouts_except]. Consequences described include cookie-based crede...

PT-2025-35809

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings affected versions not specified Description A vulnerability in Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a targeted user to an untrusted website. The issue stemmed from insufficient...

The vulnerability of the soapcgi_main() function in the SOAP Service component of the soap.cgi file from the D-Link DIR-852 router’s software, allowing a hacker to execute arbitrary commands.

The vulnerability of the soapcgimain function in the SOAP Service component of the soap.cgi file from the D-Link DIR-852 router’s software lies in the lack of data cleaning measures at the control level when processing the service parameter. Exploiting this vulnerability allows an attacker to...

The vulnerability of the software component responsible for managing and publishing geodata on the OSGeo GeoServer server allows a perpetrator to upload arbitrary files.

The vulnerability of the software components used for managing and publishing geodata on the OSGeo GeoServer server is related to insufficient testing of requests on the server side. Exploiting this vulnerability could allow a malicious actor to upload arbitrary files remotely...