CVE-2025-8020

All versions of the package private-ip are vulnerable to Server-Side Request Forgery SSRF where an attacker can provide an IP or hostname that resolves to a multicast IP address 224.0.0.0/4 which is not included as part of the private IP ranges in the package's source code...

TOTOLink T6 System Arbitrary Command Execution

The vulnerability of the cckeckKeepAlive function in the TOTOLink T6 mesh-system’s software lies in the lack of measures taken to neutralize special elements during the processing of the ipAddr parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

SUSE CVE-2025-8036

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

CVE-2025-8020

All versions of the package private-ip are vulnerable to Server-Side Request Forgery SSRF where an attacker can provide an IP or hostname that resolves to a multicast IP address 224.0.0.0/4 which is not included as part of the private IP ranges in the package's source code...

CVE-2025-8020

CVE-2025-8020 affects the private-ip package. All versions are reported vulnerable to Server-Side Request Forgery (SSRF) by accepting an IP/hostname that resolves to a multicast address (224.0.0.0/4), which is not excluded by the package’s private IP range checks. Multiple sources (RH, NVD, GitHu...

CVE-2025-8020: Server-Side Request Forgery (SSRF)

All versions of the package private-ip are vulnerable to Server-Side Request Forgery SSRF where an attacker can provide an IP or hostname that resolves to a multicast IP address 224.0.0.0/4 which is not included as part of the private IP ranges in the package's source code...

CVE-2025-8036

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

CVE-2025-8036

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

UBUNTU-CVE-2025-8036

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

Mozilla Firefox ESR < 140.1

The version of Firefox ESR installed on the remote Windows host is prior to 140.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-59 advisory. - Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of...

Mozilla Firefox ESR < 140.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-59 advisory. - Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140...

CVE-2025-3621

Vulnerabilities in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. vulnerabilities: Improper Neutralization of Special Elements used in a Command 'Command Injection' Use of Hard-coded Credentials Improper Authentication Binding to an...

CVE-2025-3621

Vulnerabilities in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. vulnerabilities: Improper Neutralization of Special Elements used in a Command 'Command Injection' Use of Hard-coded Credentials Improper Authentication Binding to an...

CVE-2025-3621 Remote Code Execution in ProTNS ActADUR

Vulnerabilities in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. vulnerabilities: Improper Neutralization of Special Elements used in a Command 'Command Injection' Use of Hard-coded Credentials Improper Authentication Binding to an...

CVE-2025-3621

CVE-2025-3621 affects ProTNS ActADUR local server. Multiple vulnerabilities in ActADUR (v2.0.1.9 and earlier) enable remote code execution via remote command injection, with issues including hard-coded credentials, improper authentication, and binding to an unrestricted IP. Exploitation vectors a...

PT-2025-29540 · Protns · Actadur

Name of the Vulnerable Software and Affected Versions: ActADUR versions 2.0.1.9 through 2.0.1.9 Description: The ActADUR local server product, developed and maintained by ProTNS, allows for Remote Code Inclusion on host systems. The vulnerability has been rated as critical and includes issues suc...

cloud-init: Cloud init permissions flaw

An access permissions flaw was found in cloud-init. When a non-x86 platform is detected, cloud-init grants root access to a hardcoded URL with a local IP address, which creates a security exposure...

VulnCheck KEV: CVE-2024-51977

An unauthenticated attacker who can access either the HTTP service TCP port 80, the HTTPS service TCP port 443, or the IPP service TCP port 631, can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mntinfo.csv can be accessed via a GET request and no...

CVE-2025-49537 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user...

PT-2025-28747 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be exploited by a high-privileged attacker to inject malicious scripts into vulnerable form fields...