CVE-2023-37482

CVE-2023-37482 affects Siemens SIMATIC web servers (e.g., SIMATIC S7-1200/1500 family). The vulnerability stems from login response timing not being normalized, enabling an unauthenticated remote attacker to perform user enumeration by distinguishing valid vs. invalid usernames via a side channel...

CVE-2023-37482

The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames...

February 11, 2025—Hotpatch KB5052106 (OS Build 20348.3148)

None None...

CVE-2024-13643 Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification

The Zox News - Professional WordPress News & Magazine Theme plugin for WordPress is vulnerable to unauthorized data modification. This vulnerability can lead to privilege escalation and denial of service conditions due to missing capability checks on the backupoptions and resetoptions functions i...

CVE-2024-11771: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functionality...

CVE-2025-24872: Incorrect Authorization

The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality within the ABAP Build Framework, an attacker could call the transaction and view its details. This has a limited impact...

Azure Linux 3.0 Security Update: kernel (CVE-2024-45009)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45009 advisory. - In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only decrement addaddraccepte...

CVE-2025-1076

A Stored Cross-Site Scripting Stored XSS vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality...

CVE-2025-0675

Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure...

CVE-2025-0675: Hidden Functionality

Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure...

Cisco Secure Email Gateway Privelege Escalation (cisco-sa-esa-sma-wsa-multi-yKUJhS34)

According to its self-reported version, Secure Email Gateway is affected by a vulnerability. - A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance coul...

Elber Communications Equipment 安全漏洞

Elber Communications Equipment is a communications equipment from Elber Corporation. A security vulnerability exists in Elber Communications Equipment that stems from the presence of unauthenticated device configurations and the disclosure of hidden client functionality...

CVE-2025-0675 Elber Communications Equipment Hidden Functionality

Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure...

CVE-2025-0675 Elber Communications Equipment Hidden Functionality

Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure...

CVE-2025-0675

CVE-2025-0675 affects Elber products (Elber Communications Equipment). The public records describe an authentication bypass that enables unauthorized access to password management, effectively allowing attackers to overwrite any user password and gain access to protected areas of affected devices...

CVE-2025-1076

A Stored Cross-Site Scripting Stored XSS vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality...

CVE-2025-1076 Stored Cross-Site Scripting vulnerability in Holded

A Stored Cross-Site Scripting Stored XSS vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality...

CVE-2025-1076 Stored Cross-Site Scripting vulnerability in Holded

A Stored Cross-Site Scripting Stored XSS vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality...

CVE-2025-1076

CVE-2025-1076 describes a Stored XSS vulnerability in Holded’s application, affecting the editable name and icon fields within the Activities feature. The root cause is storing a JavaScript payload in those parameters, enabling an attacker to inject script via standard input fields. The issue is ...

CVE-2022-21217

An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted network request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability...