EUVD-2025-37731

By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and from there, relay connections...

MINI-RH6Q-2PH3-3F3F

Bulletin has no description...

MINI-Q3QV-X632-FF89

Bulletin has no description...

MINI-CG8M-H3F4-W5FM

Bulletin has no description...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: A crash occurred during UFFDIOMOVE when PMD is a migration entry. When UFFDIOMOVE encounters a migration PMD entry, it proceeds to obtain a folio and access it, even though the entry type is swpentryt. We have added...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack-out-of-bounds write in tc entry parsing The parameter TCAMQPRIOTCENTRYINDEX is validated using NLAPOLICYMAXNLAU32, TCQOPTMAXQUEUE, which allows the value TCQOPTMAXQUEUE 16. This leads to a stack write...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD in arp,neighreduce when using nexthop objects When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of...

CVE-2025-64387 CLICKJACKING

The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page controlled by the attacker in order to deceive the victim. This deception can range from making the victim click on a button to making them enter their login...

CVE-2025-64387

CVE-2025-64387 is a documented clickjacking vulnerability described across multiple feeds (NVD/Red Hat/CIRCL etc.). The core issue is UI deception via embedding the vulnerable page in an attacker‑controlled page, potentially prompting users to click or enter credentials. NVD notes a CVSS v4.0 bas...

Online Event Judging System action.php File SQL Injection Vulnerability

Online Event Judging System is an online event judging system. Online Event Judging System suffers from a SQL injection vulnerability, which originates from the lack of validation of externally entered SQL statements in the parameter content in the file /ajax/action.php. An attacker can exploit...

IPFire Cross-Site Scripting Vulnerability (CNVD-2025-27648)

IPFire is an open source Linux distribution from the IPFire organization, used primarily as a router and firewall. IPFire suffers from a cross-site scripting vulnerability that stems from not properly cleaning or coding the IGNOREENTRYREMARK parameter, which can be exploited by an attacker to...

CGA-3QCR-CW23-M4G4

Bulletin has no description...

CGA-749X-PQG5-VHWW

Bulletin has no description...

CGA-5GJX-4R4C-PCMV

Bulletin has no description...

CGA-87H3-XH8F-46HF

Bulletin has no description...

CGA-54FV-7798-WCR3

Bulletin has no description...

CGA-74M7-8PMG-2G8W

Bulletin has no description...

EUVD-2025-37028

Kanova Android App version 1.0.27 package name com.karelane, developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain unauthorized access to user details and obtain group information, including entry codes, by manipulating API request parameters. Successful...

CVE-2025-61119

Kanova Android App version 1.0.27 package name com.karelane, developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain unauthorized access to user details and obtain group information, including entry codes, by manipulating API request parameters. Successful...

PT-2025-44427

Name of the Vulnerable Software and Affected Versions Kanova versions 1.0.27 Description The Kanova Android App has issues with how access is controlled. An attacker could manipulate parameters in requests to the application's API and gain unauthorized access to user details and group information...