PT-2025-31866 · Cyberghost · Cyberghostvpnsetup.Exe

Name of the Vulnerable Software and Affected Versions: CyberGhostVPNSetup.exe versions affected versions not specified Description: CyberGhostVPNSetup.exe Windows installer is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attacks. This allows a malicio...

The vulnerability of the Parameter Handler component in the downloadpass.html file of the FTP server Wing allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Parameter Handler component in the downloadpass.html file of the FTP server Wing is related to errors in system settings or configuration. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information by introducing malicious...

PT-2025-31142

Name of the Vulnerable Software and Affected Versions netavark affected versions not specified Description A vulnerability exists in the netavark package, a network stack for containers used with Podman. Due to the removal of the dns.podman search domain, netavark may return external servers if a...

JetBrains YouTrack 安全漏洞

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in JetBrains YouTrack that stems from an iframe...

dag-factory 操作系统命令注入漏洞

dag-factory is an Astronomer open source by building Apache Airflow DAG. An operating system command injection vulnerability exists in dag-factory 0.23.0a8 and earlier versions, which stems from a misconfiguration of the cicd.yml workflow and could lead to arbitrary code execution...

CVE-2025-34114

A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments, due to the absence of critical HTTP response headers including Content-Security-Policy, Referrer-Policy, Permissions-Policy,...

CVE-2025-34114 OpenBlow Missing Critical Security Headers

A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments, due to the absence of critical HTTP response headers including Content-Security-Policy, Referrer-Policy, Permissions-Policy,...

CVE-2025-34114 OpenBlow Missing Critical Security Headers

A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments, due to the absence of critical HTTP response headers including Content-Security-Policy, Referrer-Policy, Permissions-Policy,...

PT-2025-30891 · Unknown · Openblow Whistleblowing Platform

Name of the Vulnerable Software and Affected Versions: OpenBlow whistleblowing platform affected versions not specified Description: A client-side security misconfiguration exists due to the absence of critical HTTP response headers, including Content-Security-Policy, Referrer-Policy,...

CVE-2025-34140

An authorization bypass vulnerability exists in ETQ Reliance legacy CG and NXG SaaS platforms. By appending a specific URI suffix to certain API endpoints, an unauthenticated attacker can bypass access control checks and retrieve limited sensitive resources. The root cause was a misconfiguration ...

CVE-2025-44658

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them ...

CVE-2025-34140

An authorization bypass vulnerability exists in ETQ Reliance legacy CG and NXG SaaS platforms. By appending a specific URI suffix to certain API endpoints, an unauthenticated attacker can bypass access control checks and retrieve limited sensitive resources. The root cause was a misconfiguration ...

ETQ Reliance 安全漏洞

ETQ Reliance is a quality management system from ETQ Corporation. A security vulnerability exists in ETQ Reliance that stems from a misconfiguration of the API authorization logic, which could allow an unauthenticated attacker to bypass access control checks and retrieve limited sensitive resourc...

CVE-2025-44658

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them ...

CVE-2025-44658

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them ...

CVE-2025-44658

Netgear RAX30 appears affected (version V1.0.10.94). The issue is a PHP-FPM misconfiguration that fails to limit PHP-FPM to .php extensions, allowing uploaded scripts with alternate extensions to be executed as PHP. Consequences described include remote code execution, information disclosure, or ...

PT-2025-30295 · NetGear · Netgear Rax30

Name of the Vulnerable Software and Affected Versions: Netgear RAX30 version 1.0.10.94 Description: A PHP-FPM misconfiguration vulnerability exists due to not restricting PHP-FPM to only handle .php extensions. An attacker can exploit this by uploading malicious scripts with alternate extensions...

CVE-2025-53757

This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router web interface. A remote attacker could exploit this vulnerability by capturing the session cookies transmitted over an unsecure HTTP...

The vulnerability of HashiCorp’s Vault and Vault Enterprise storage platforms, which involve improper configuration of permissions for critical resources, allows attackers to bypass authentication processes.

The vulnerability of the HashiCorp Vault and Vault Enterprise archiving platforms relates to the improper assignment of permissions for critical resources. Exploiting this vulnerability could allow a malicious actor to bypass authentication processes...

CVE-2025-49831

CVE-2025-49831 affects CyberArk Secrets Manager Self-Hosted and Conjur OSS, with a bypass of IAM authenticator possible when traffic from Secrets Manager to AWS is routed through a misconfigured network device. Affected versions include Secrets Manager Self-Hosted before 13.5.1/13.6.1 and Conjur ...