CVE-2025-27025 Improper File Access in Infinera G42

The target device exposes a service on a specific TCP port with a configured endpoint. The access to that endpoint is granted using a Basic Authentication method. The endpoint accepts also the PUT method and it is possible to write files on the target device file system. Files are written as root...

CVE-2025-27025 Improper File Access in Infinera G42

The target device exposes a service on a specific TCP port with a configured endpoint. The access to that endpoint is granted using a Basic Authentication method. The endpoint accepts also the PUT method and it is possible to write files on the target device file system. Files are written as root...

CVE-2025-27025

CVE-2025-27025 affects Infinera G42 devices. A service on a TCP port with Basic Authentication allows PUT and GET; directory traversal can write files to arbitrary locations as root and read arbitrary files. This yields full filesystem access and modification. Exploitation status and patches are ...

CVE-2025-27024 Improper File Access in Infinera G42

Unrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users to read/write OS files via SFTP connections. Details: Account members of the Network Administrator profile can access the target machine via SFTP with the same credentials used f...

CVE-2025-27024

CVE-2025-27024 affects Infinera G42, version R6.1.3. The vulnerability arises from improper access control in the SFTP service, allowing remote authenticated users (Network Administrator profile) to read and write OS files outside the chroot, using the same credentials as SSH CLI. Impact is confi...

CVE-2025-27024 Improper File Access in Infinera G42

Unrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users to read/write OS files via SFTP connections. Details: Account members of the Network Administrator profile can access the target machine via SFTP with the same credentials used f...

CVE-2025-27022

A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests. Details: Lack or insufficient validation of user-supplied input allows authenticated users to access all files on the target...

CVE-2025-24331 Nokia Single RAN baseband OAM service extensive capabilities

The Single RAN baseband OAM service is intended to run as an unprivileged service. However, it initially starts with root privileges and assigns certain capabilities before dropping to an unprivileged level. The capabilities retained from the root period are considered extensive after the privile...

PT-2025-27621 · Infinera · G42

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns a service exposed on a specific TCP port with a configured endpoint that uses Basic Authentication. This endpoint is vulnerable to Directory Traversal attacks, allowing...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows a hacker to gain access to read and write arbitrary files.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability can allow an attacker to gain read and write access to arbitrary files through a specially crafted HTML page...

WordPress plugin Vikinger 路径遍历漏洞

WordPress Vikinger is a WordPress blog theme developed by a foreign developer. WordPress Vikinger has a path traversal vulnerability that stems from insufficient file path validation in the function vikingerdeleteactivitymediaajax, which can be exploited by an attacker to tamper with the system...

PT-2025-27618 · Infinera · Infinera G42

Name of the Vulnerable Software and Affected Versions: Infinera G42 version R6.1.3 Description: The issue is related to insufficient input validation in the WebGUI CLI web interface of the Infinera G42 appliance. This allows remote authenticated users to read all OS files via crafted CLI commands...

@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix

Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue. Thank you to Elad Beber Cymulate for reporting these issues...

GHSA-HC55-P739-J48W @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix

Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue. Thank you to Elad Beber Cymulate for reporting these issues...

GHSA-Q66Q-FX2P-7W4M @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling

Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve. Thank you to Elad Beber Cymulate for reporting these issues...

PT-2025-27533 · Unknown · Campcodes Employee Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Employee Management System version 1.0 Description: A critical issue was found in Campcodes Employee Management System, affecting an unknown part of the file /changepassemp.php. The manipulation of the ID argument leads to SQL...

PT-2025-27502 · Unknown · Code-Projects Simple Pizza Ordering System

Name of the Vulnerable Software and Affected Versions: code-projects Simple Pizza Ordering System version 1.0 Description: A critical issue affects the processing of the file /editcus.php. The manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely. The exploi...

PT-2025-27543 · Laravel · Laravel

Name of the Vulnerable Software and Affected Versions: Monero Project's Laravel-based forum software affected versions not specified Description: A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the...

PT-2025-27532 · Unknown · Campcodes Employee Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Employee Management System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file "/process/aprocess.php". The manipulation of the mailuid argument leads to SQL injection...

CVE-2025-49521

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In...