Directory Traversal

Overview sirv is a The optimized & lightweight middleware for serving requests to static assets Affected versions of this package are vulnerable to Directory Traversal via the viaLocal function, which uses a dirname prefix. An attacker can access files outside the intended public directory by...

CVE-2025-55242

Exposure of sensitive information to an unauthorized actor in Xbox allows an unauthorized attacker to disclose information over a network...

Microsoft XBox 信息泄露漏洞

Microsoft XBox is a gaming application from Microsoft Corporation. An information disclosure vulnerability exists in Microsoft XBox, which arises from the exposure of sensitive information and could allow an unauthorized attacker to disclose information over the network...

SunPower PVS6

RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to gain full access to the device, enabling them to replace firmware, modify settings, disable the device, create SSH tunnels, and manipulate attached devices. 2. RECOMMENDED PRACTICES CISA recommends users take...

PT-2025-35121

Name of the Vulnerable Software and Affected Versions AIML Solutions for HCL SX affected versions not specified Description AIML Solutions for HCL SX is susceptible to a URL validation issue that could allow attackers to perform a server-side request forgery SSRF attack. This may enable...

Linux Distros Unpatched Vulnerability : CVE-2019-15694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the...

Linux Distros Unpatched Vulnerability : CVE-2019-15679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear ...

INVT VT-Designer and HMITool

RISK EVALUATION Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary code in the context of the current process. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:...

CVE-2025-53763

The CVE-2025-53763 entry concerns Azure Databricks with an improper access control issue that can allow an unauthenticated, network-based attacker to elevate privileges. Affected component is Azure Databricks (per multiple sources), with root cause described as access control misconfiguration ena...

vite-plugin-static-copy files not included in `src` are possible to access with a crafted request

Summary Files not included in src was possible to access with a crafted request. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Arbitrary files can be disclosed by exploiting this vulnerability. Details Consider the...

Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module (Update A)

RISK EVALUATION Successful exploitation of this vulnerability could result in a remote attacker being able to delay the processing of the Web server function and prevent legitimate users from utilizing the Web server function by sending a specially crafted HTTP request. 2. RECOMMENDED PRACTICES...

Linux Distros Unpatched Vulnerability : CVE-2020-2660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.7.28 and prior and 8.0.18 and...

UltraVNC < 1.2.2.4 Multiple Vulnerabilities

The version of UltraVNC Service installed on the remote Windows host is prior to 1.2.2.4. It is, therefore, affected by multiple vulnerabilities: - UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially result code execution. This...

CVE-2025-43986

An issue was discovered on KuWFi GC111 GC111-GL-LM321V3.020191211 devices. The TELNET service is enabled by default and exposed over the WAN interface without authentication...

Linux Distros Unpatched Vulnerability : CVE-2021-2390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior...

CVE-2025-33051

Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network...

CVE-2025-53766

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network...

CVE-2025-8452

By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brother-provided firmware. This serial number can, in turn, can be leveraged by the flaw described by CVE-2024-51978 to calculate the default...

Rockwell Automation 1756-EN4TR, 1756-EN4TRXT (Update B)

RISK EVALUATION Successful exploitation of these vulnerabilities could result in an attacker causing a denial of service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network...

Rockwell Automation FactoryTalk Action Manager

RISK EVALUATION Successful exploitation of this vulnerability could allow a local unauthenticated attacker to listen to communications and manipulate the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability,...