EUVD-2025-34186

A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can be abused to perform XXE, resulting in a temporary denial-of-service...

CVE-2025-9066

Summary: CVE-2025-9066 affects Rockwell Automation’s FactoryTalk ViewPoint. Unauthenticated attackers can abuse SOAP requests to trigger XML External Entity (XXE) processing, resulting in a temporary denial-of-service. The vulnerability is documented across multiple sources (NVD, Rockwell advisor...

MAL-2025-48407 Malicious code in company-overview (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7bf8d3a72c075224c157c2cf2307e520204ee333e3107d1f1b1bc6992b21dd4 Any computer that has this package installed or running should be considered...

PT-2025-42152

Name of the Vulnerable Software and Affected Versions Azure Container Instances ACI affected versions not specified Description An issue exists in Azure Container Instances where external control of file names or paths can allow an authorized attacker to elevate privileges locally. The...

PT-2025-42151

Name of the Vulnerable Software and Affected Versions Azure Container Instances ACI affected versions not specified Description An issue exists in Azure Container Instances where external control of a file name or path can allow an authorized attacker to elevate privileges locally. The flaw...

PT-2025-42127

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description An issue exists in Windows Core Shell that allows an unauthorized attacker to perform spoofing over a network through external control of a file name or path. Recommendations At the moment,...

Rockwell Automation FactoryTalk ViewPoint 安全漏洞

Rockwell Automation FactoryTalk ViewPoint is a web-based client application from Rockwell Automation, Inc. A security vulnerability exists in Rockwell Automation FactoryTalk ViewPoint that originates from an unauthenticated attacker who can execute an XXE attack using a specially crafted SOAP...

PT-2025-41904

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 144 Thunderbird versions prior to 144 Description A flaw exists where links within a sandboxed iframe can trigger the opening of an external application on Android devices, bypassing the necessary "allow-" permissions...

FreeBSD : zeek -- information leak vulnerability (50fd6a75-0587-4987-bef2-bb933cd78ea1)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 50fd6a75-0587-4987-bef2-bb933cd78ea1 advisory. Tim Wojtulewicz of Corelight reports: The KRB analyzer can leak information about hosts in analyzed...

PT-2025-42077

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description An issue exists in Windows Core Shell that allows an unauthorized attacker to perform spoofing over a network through external control of a file name or path. Recommendations At the moment,...

Microsoft Azure Connected Machine Agent 访问控制错误漏洞

Microsoft Azure Connected Machine Agent is the ability of Microsoft Corporation USA to manage Windows and Linux computers hosted outside of Azure on a corporate network or other cloud provider. An access control error vulnerability exists in Microsoft Azure Connected Machine Agent, which stems fr...

PT-2025-41915

Name of the Vulnerable Software and Affected Versions FactoryTalk ViewPoint affected versions not specified Description A security issue exists in FactoryTalk ViewPoint that allows unauthenticated attackers to achieve XML External Entity XXE attacks. Specific SOAP requests can be exploited to...

CVE-2025-62361

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified in the control.php endpoint of the WeGIA application, specifically in the nextPage parameter metodo=listarTodos...

EUVD-2025-34084

Mattermost Desktop App versions = 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL...

CVE-2025-62361 WeGIA Open Redirect Vulnerability in `control.php` endpoint `nextPage` parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle)

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified in the control.php endpoint of the WeGIA application, specifically in the nextPage parameter metodo=listarTodos...

CVE-2025-58084

Mattermost Desktop App versions = 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL...

CVE-2025-58084

Mattermost Desktop App versions = 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL...

CVE-2025-58084 Mattermost Desktop App crashes when clicking on malformed external URL

Mattermost Desktop App versions = 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL...

CVE-2025-58084

Mattermost Desktop App up to version 5.13.0 is affected. The issue is due to improper validation of URLs external to configured Mattermost servers, allowing a malicious server to crash the user’s application by sending a malformed external URL. Affected product: Mattermost Desktop App (versions

CVE-2025-58084 Mattermost Desktop App crashes when clicking on malformed external URL

Mattermost Desktop App versions = 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL...