The vulnerability of the FortiOS operating systems and the FortiProxy proxy server, related to insufficient restrictions on communication channels for specified endpoints, allows attackers to gain unauthorized access to protected information.

The vulnerability of the FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks is related to insufficient restrictions on communication channels for specified endpoints. Exploiting this vulnerability can allow a malicious actor to gain unauthorized acce...

CVE-2025-23178

The CVE-2025-23178 entry corresponds to Ribbon Communications Apollo 9608 SBC with a vulnerability described as CWE-923: Improper Restriction of Communication Channel to Intended Endpoints. Connected sources indicate affected product as Apollo 9608 (appearing in CNNVD and PT-2025-18182); one note...

CVE-2025-23178 Ribbon Communications - CWE-923: Improper Restriction of Communication Channel to Intended Endpoints

CWE-923: Improper Restriction of Communication Channel to Intended Endpoints...

CVE-2025-4088

A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. This vulnerability affects Firefox 1...

Zimbra 安全漏洞

Zimbra is an open source email collaboration platform from Zimbra, Inc. A security vulnerability exists in Zimbra versions 9.0 through 10.1, which stems from a lack of CSRF token validation on GraphQL endpoints, which could lead to unauthorized operations...

PT-2025-27746

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.12.0-54.el10.aarch64 Description: A vulnerability in the Linux kernel has been resolved, specifically in the RDMA/mlx5 component. The issue occurs upon RQ destruction when the firmware command fails, causing...

VMware Spring Boot 安全漏洞

VMware Spring Boot is a set of open source frameworks from VMware, Inc. A security vulnerability exists in VMware Spring Boot that stems from EndpointRequest.to creating a null/ matcher when the endpoint is disabled or unexposed, which could lead to a security constraint bypass...

CVE-2025-29722

A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missing CSRF protection on sensitive endpoints...

CVE-2025-3808

A vulnerability has been found in zhenfeng13 My-BBS 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Multiple...

CVE-2025-42604

This vulnerability exists in Meon KYC solutions due to debug mode is enabled in certain API endpoints. A remote attacker could exploit this vulnerability by accessing certain unauthorized API endpoints leading to detailed error messages as response leading to disclosure of system related...

CVE-2025-42601

This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote attacker could exploit this vulnerability by intercepting the request and removing the Captcha parameter leading to bypassing the Captcha verification...

CVE-2025-46546

In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This affects api/gui/asset/list, /api/gui/files/export/csv/, /api/gui/files/list, /api/gui/process/export/csv, /api/gui/process/export/xlsx, /api/gui/process/listAll,...

CVE-2025-46546

In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This affects api/gui/asset/list, /api/gui/files/export/csv/, /api/gui/files/list, /api/gui/process/export/csv, /api/gui/process/export/xlsx, /api/gui/process/listAll,...

CVE-2025-46546

CVE-2025-46546 concerns Sherpa Orchestrator 141851 where an authenticated user can perform multiple time-based blind SQL injections. Affects API endpoints across GUI and process/file/task listings (examples: api/gui/asset/list; api/gui/files/export/csv/; api/gui/files/list; api/gui/process/export...

PT-2025-17907 · Easyvirt · Easyvirt Co2Scope +1

Name of the Vulnerable Software and Affected Versions: EasyVirt DCScope versions 8.6.4 and earlier EasyVirt CO2Scope versions 1.3.4 and earlier Description: The issue allows remote authenticated attackers to execute arbitrary SQL commands. This can be achieved via various parameters to specific A...

Growatt Cloud Applications Information Disclosure Vulnerability

Growatt Cloud Applications is a monitoring platform from Growatt in China. An information disclosure vulnerability exists in Growatt Cloud Applications version 3.6.0 and prior versions, which can be exploited by an unauthenticated attacker to query API endpoints and obtain device details...

PT-2025-17872 · Unknown · Sherpa Orchestrator

Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: The issue allows an authenticated user to perform multiple time-based blind SQL injections. This affects several API endpoints, including "api/gui/asset/list", "api/gui/files/export/csv/",...

PT-2025-17769 · Animate · Animate

Name of the Vulnerable Software and Affected Versions: Animate versions n/a through 0.5 Description: A Server-Side Request Forgery SSRF issue allows for Server Side Request Forgery. This issue is related to the Animate software. Recommendations: For Animate versions n/a through 0.5, consider...

CVE-2025-42602

This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentication process. A remote attacker could exploit this vulnerability by intercepting and manipulating the responses through API request body leading to...

CVE-2025-42605 Improper Access Control Vulnerability in Meon Bidding Solutions

This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modification, or cancellation operations. An authenticated remote attacker could exploit this vulnerability by manipulating parameter in the API request body to...