1294 matches found
CVE-2025-12485
Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step. This issue affects the following versions :...
JumpServer 安全漏洞
JumpServer is an open source bastion machine from Hangzhou, China-based Feizhiyun Information Technology JumpServer. A security vulnerability exists in JumpServer versions prior to v3.10.21-lts and prior to v4.10.12-lts, which originates from a specially crafted message that can be used by a...
CVE-2025-46582
A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the device's communication private key, resulting in key exposure and impacting communication security...
CVE-2025-46582 Private Key Disclosure Vulnerability in ZTE ZXMP M721 Product
A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the device's communication private key, resulting in key exposure and impacting communication security...
CVE-2025-46582
CVE-2025-46582 affects ZTE ZXMP M721. A low-privilege user can bypass authorization to view the device’s private key, leading to private-key disclosure and potential compromise of secure communications. The public descriptions consistently state that this enables key exposure and threatens commun...
CVE-2025-46582 Private Key Disclosure Vulnerability in ZTE ZXMP M721 Product
A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the device's communication private key, resulting in key exposure and impacting communication security...
Atlassian Jira Align 安全漏洞
Atlassian Jira Align is a strategic-grade agile management platform from Atlassian Australia. A security vulnerability exists in Atlassian Jira Align that stems from an authorization issue that could lead to a low-privileged user modifying another user's private manifest...
CVE-2025-62577
ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged user with access to the management server may obtain database credentials, potentially allowing execution of OS commands with administrator privileges...
CVE-2025-62577
ETERNUS SF by Fsas Technologies Inc. is affected by an incorrect default permissions (CWE-276) vulnerability. A low-privileged user with access to the management server may obtain database credentials and could potentially execute OS commands with administrator privileges . The issue is associate...
OpenText Flipper 安全漏洞
OpenText Flipper is a vendor self-submission invoice portal extension package from OpenText Canada. A security vulnerability exists in OpenText Flipper version 3.1.2, which stems from insufficient access control granularity and could lead to a low-privileged user interacting with the back-end API...
EUVD-2025-34847
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authorization logic of the affected device allows an authenticated, low-privileged user to execute the administrative ping function, which is restricted ...
CVE-2025-6894
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authorization logic of the affected device allows an authenticated, low-privileged user to execute the administrative ping function, which is restricted ...
CVE-2025-6893
CVE-2025-6893 affects Moxa network security appliances/routers. A broken access control flaw in the /api/v1/setting/data endpoint lets a low-privileged, authenticated user call the API without required permissions, enabling access/modification of system configuration and potential privilege escal...
EUVD-2025-34774
Boolean SQL injection vulnerability in the web app of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows a low level priviliged user that has access to the platform, to execute arbitrary SQL commands via the datafine parameter...
CVE-2025-56700
Boolean SQL injection vulnerability in the web app of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows a low level priviliged user that has access to the platform, to execute arbitrary SQL commands via the datafine parameter...
CVE-2025-9804
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level...
CVE-2025-9804
The CVE-2025-9804 entry concerns multiple WSO2 products (e.g., API Manager family) with an improper access-control flaw due to insufficient permission enforcement in internal SOAP Admin Services and System REST APIs. The root cause is limited access-control checks on internal interfaces, allowing...
CVE-2025-56700
CVE-2025-56700 describes a boolean SQL injection in the web app of Centrax Open PSIM 6.1 (Base Digitale Group spa). The flaw is triggered via the datafine parameter and can be exploited by a low-privileged user with platform access to execute arbitrary SQL commands. The provided documents do not ...