CVE-2025-4040

Authorization Bypass Through User-Controlled Key vulnerability in Turpak Automatic Station Monitoring System allows Privilege Escalation. This issue affects Automatic Station Monitoring System: before 5.0.6.51...

CVE-2025-4040 IDOR in Turpak's Automatic Station Monitoring System

Authorization Bypass Through User-Controlled Key vulnerability in Turpak Automatic Station Monitoring System allows Privilege Escalation. This issue affects Automatic Station Monitoring System: before 5.0.6.51...

Realistic Vulnerabilities of Decoy-State Quantum Key Distribution

We analyze realistic vulnerabilities of decoy-state quantum key distribution QKD arising from the combination of laser damage attack LDA and unambiguous state discrimination USD. While decoy-state QKD is designed to protect against photon-number-splitting and beam-splitting attacks by accurately...

Turpak Automatic Station Monitoring System 安全漏洞

Turpak Automatic Station Monitoring System is an automated gas station monitoring system from Turpak. A security vulnerability exists in Turpak Automatic Station Monitoring System versions prior to 5.0.6.51, which originates from bypassing authorization via a user control key and may result in...

CVE-2025-4040: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Turpak Automatic Station Monitoring System allows Privilege Escalation. This issue affects Automatic Station Monitoring System: before 5.0.6.51...

PT-2025-30265

Name of the Vulnerable Software and Affected Versions Turpak Automatic Station Monitoring System versions prior to 5.0.6.51 Description An authorization bypass exists in Turpak Automatic Station Monitoring System due to a user-controlled key, allowing for privilege escalation. Recommendations...

Sensaphone WEB600 Monitoring System 安全漏洞

Sensaphone WEB600 Monitoring System is a remote monitoring and data logging device from Sensaphone USA. A security vulnerability exists in Sensaphone WEB600 Monitoring System version 1.6.5.H and prior versions, which stems from vulnerability to cross-site scripting attacks that could lead to the...

CVE-2024-55040: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted GET requests to /@.xml, placing payloads in the g7200, g7300, g4601, and g1F02 parameters...

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Sudo_Project Sudo

CVE-2025-32463 Detection Framework A comprehensive security m...

CVE-2025-6185

Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URL parameters, which would execute in a client browser when accessed by a user, steal session tokens, and control the service...

CVE-2025-34121

An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The wizards/post2file.php script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP files to the webroot. Successful exploitation results in...

CVE-2025-6185

Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URL parameters, which would execute in a client browser when accessed by a user, steal session tokens, and control the service...

CVE-2025-6185: Improper Neutralization of Input During Web Page Generation

Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URL parameters, which would execute in a client browser when accessed by a user, steal session tokens, and control the service...

CVE-2025-6185 Leviton AcquiSuite and Energy Monitoring Hub Cross-site Scripting

Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URL parameters, which would execute in a client browser when accessed by a user, steal session tokens, and control the service...

CVE-2025-6185 Leviton AcquiSuite and Energy Monitoring Hub Cross-site Scripting

Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URL parameters, which would execute in a client browser when accessed by a user, steal session tokens, and control the service...

CVE-2025-6185

Leviton AcquiSuite and Energy Monitoring Hub are affected by a cross-site scripting (XSS) vulnerability in URL parameters, enabling an attacker to craft a payload that executes in a user’s browser, potentially stealing session tokens and allowing control of the service. Root cause: XSS in URL par...

CISA Releases Three Industrial Control Systems Advisories

CISA released three Industrial Control Systems ICS advisories on July 17, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-198-01 Leviton AcquiSuite and Energy Monitoring Hub ICSMA-25-198-01 Panoramic Corporati...

Backscattering-Based Security in Wireless Power Transfer Applied to Battery-Free BLE Sensors

The integration of security and energy efficiency in Internet of Things systems remains a critical challenge, particularly for battery-free and resource-constrained devices. This paper explores the scalability and protocol-agnostic nature of a backscattering-based security mechanism by integratin...

Thought Purity: Defense Paradigm for Chain-Of-Thought Attack

While reinforcement learning-trained Large Reasoning Models LRMs, e.g., Deepseek-R1 demonstrate advanced reasoning capabilities in the evolving Large Language Models LLMs domain, their susceptibility to security threats remains a critical vulnerability. This weakness is particularly evident in...

Leviton AcquiSuite和Leviton Energy Monitoring Hub 跨站脚本漏洞

Leviton AcquiSuite and Leviton Energy Monitoring Hub are industrial-grade energy data collection and monitoring gateways from Leviton Corporation. A cross-site scripting vulnerability exists in Leviton AcquiSuite and Leviton Energy Monitoring Hub, which stems from a cross-site scripting...