CVE-2025-46717 sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no or very limited sudo privileges can determine whether files exists in folders that they otherwise cannot access using sudo --list . Users with local access to a machine can discover the...

CVE-2025-46717 sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no or very limited sudo privileges can determine whether files exists in folders that they otherwise cannot access using sudo --list . Users with local access to a machine can discover the...

CVE-2025-20194

A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this...

Ensure That Scripts Writable by Low-Privilege Users Cannot Be Configured in the sudoers Configuration File

The sudo command enables a specified common user to execute certain programs with the root permission. The corresponding configuration file is /etc/sudoers. The administrator can configure rules to enable some scripts or binary files to run with the root permission. Therefore, only the root user...

Open WebUI 跨站脚本漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site scripting vulnerability exists in versions of Open WebUI prior to 0.6.6, which stems from a low-privileged user being able to upload HTML files containing JavaScript code, which...

CVE-2025-46690

Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request...

CVE-2025-46690

Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request...

CVE-2025-26477

Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

CVE-2022-28851

Adobe Experience Manager versions 6.5.13.0 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's...

CVE-2025-46544

In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles...

CVE-2025-46544

In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles...

Unspecified Vulnerability in Oracle MySQL (CNVD-2025-17362)

Oracle MySQL is an open source relational database management system.MySQL Client is a MySQL client, a program used to communicate with a server to process information in a database managed by the server. A security vulnerability exists in MySQL Client for Oracle MySQL that originates from a...

CVE-2025-26477

Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

CVE-2025-2073

Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS 6.1, 5.15, 5.10, 5.4, 4.19 allows a local attacker with low privileges to trigger an out-of-bounds read, potentially leading to information disclosure...

CVE-2025-0101

A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes some functions to work unexpected or stop working at all. Both during runtime and after a restart...

CVE-2025-0101 WAGO: Year 2038 problem

A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes some functions to work unexpected or stop working at all. Both during runtime and after a restart...

CVE-2025-0101 WAGO: Year 2038 problem

A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes some functions to work unexpected or stop working at all. Both during runtime and after a restart...

CVE-2025-0101

CVE-2025-0101 involves a 32-bit time overflow on WAGO devices where a low-privilege user can set the system date to January 19, 2038. Affected components are not exhaustively listed in the provided documents, but multiple sources (Red Hat, NVD, CVE listing, and vendor-related enrichments) describ...

Huawei PCs Authentication Bypass Vulnerability

Huawei PCs are a line of computers from the Chinese company Huawei. Huawei PCs suffer from an authentication bypass vulnerability that originates from a low-privileged user being able to bypass SDDL privilege checks, which can be exploited by an attacker to cause certain system processes to...

CVE-2025-30735

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft component: Page and Field Configuration. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...