24603 matches found
CVE-2025-11710
A compromised web process could use malicious IPC messages to cause the privileged browser process to reveal blocks of its memory. This vulnerability affects Firefox versions earlier than 144, Firefox ESR earlier than 115.29 and 140.4, and Thunderbird versions earlier than 144 and 140.4. Remediat...
What AI Reveals About Web Applications— and Why It Matters
Before an attacker ever sends a payload, they've already done the work of understanding how your environment is built. They look at your login flows, your JavaScript files, your error messages, your API documentation, your GitHub repos. These are all clues that help them understand how your syste...
CVE-2025-41707
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...
CVE-2025-41705
An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...
EUVD-2025-34147
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...
CVE-2025-41705
CVE-2025-41705 is reported as an unauthenticated MITM issue where an attacker can intercept websocket messages to obtain login credentials from the Webfrontend. Connected sources identify Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP as the affected device family, with the vulnerability described a...
EUVD-2025-34146
An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...
Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP security vulnerabilities
The Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP is an industrial grade DC uninterruptible power supply module from Phoenix Contact, Germany. A security vulnerability exists in the Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP that originates from an unauthenticated, remote attacker who can obtain...
PT-2025-41855
Name of the Vulnerable Software and Affected Versions Webfrontend affected versions not specified Description An unauthenticated remote attacker performing a man-in-the-middle MITM attack can intercept websocket messages. This interception allows access to login credentials for the Webfrontend. T...
Rockwell Automation Compact GuardLogix 5370 security vulnerability
The Rockwell Automation Compact GuardLogix 5370 is a secure programmable logic controller from Rockwell Automation, Inc. A security vulnerability exists in the Rockwell Automation Compact GuardLogix 5370 that originates from a failure when sending a specially crafted CIP unconnected explicit...
Mozilla -- Memory disclosure
[email protected] reports: A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process...
EUVD-2025-34083
Liferay Mentions Web is Vulnerable to Cross-site Scripting...
Nextcloud: BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data
Summary The Out-of-Office OOO API endpoints at /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId and /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId/now suffer from a Broken Object Level Authorization BOLA vulnerability. Any authenticated user can retrieve the out-of-office data of any other user by...
EUVD-2025-34072
Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be reused multiple times to send repeated confirmation emails to a verified email address. Under certain conditions, a verified email address...
CVE-2025-60378
Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business emai...
EUVD-2025-33800
Parallax is vulnerable to DoS via malicious p2p message...
CVE-2025-11616 Buffer Over-read when receiving improperly sized ICMPv6 packets in FreeRTOS-Plus-TCP
A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. These issues only affect applications using IPv6. Users should upgrade to the latest...
EUVD-2025-33754
A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. These issues only affect applications using IPv6. Users should upgrade to the latest...
