30140 matches found
EUVD-2025-198372
Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network...
CVE-2025-11243
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
PT-2025-47651
Name of the Vulnerable Software and Affected Versions Application Gateway versions 9.4 through 9.8 Description An out-of-bounds read issue exists in Application Gateway, potentially allowing an unauthorized attacker to elevate privileges over a network. The issue enables an attacker to escalate...
CVE-2025-11243
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
EUVD-2025-197944
The Local Syndication plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5a via the url parameter in the syndicatelocal shortcode. This is due to the use of wpremoteget instead of wpsaferemoteget which lacks protections against requests to...
EUVD-2025-197856
reebox v5 HD firmware = 1.7.20, Freebox v5 Crystal firmware = 1.7.20, Freebox v6 Révolution r1–r3 firmware = 4.7.x, Freebox Mini 4K firmware = 4.7.x, and Freebox One firmware = 4.7.x were discovered to expose subscribers' IMSI identifiers in plaintext during the initial phase of EAP-SIM...
CVE-2025-63917
PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity XXE references. The application uses .NET's XmlDocument class without disabling external entity resolution, enabling attackers to: Read arbitrary files from the victim's filesystem,...
openjdk: Enhance certificate handling (Oracle CPU 2025-10)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracl...
openjdk: Enhance String handling (Oracle CPU 2025-10)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15...
CVE-2025-63917
The PDFPatcher executable, in versions through 1.1.3.4663 , is vulnerable to an XML External Entity (XXE) injection due to the XML bookmark import functionality. The software uses the .NET XmlDocument class without disabling external entity resolution. This flaw allows attackers to read arbitrary...
CVE-2025-13160
IQ-Support developed by IQ Service International has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access specific APIs to obtain sensitive information from the internal network...
CVE-2025-62483
Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access...
CVE-2025-64741
Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access...
CVE-2025-64739
External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access...
CVE-2025-62482
Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access...
CVE-2025-64752 grist-core has path to server-side requests via websocket
grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack...
EUVD-2025-175318
Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access...
CVE-2025-64511
MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can access internal network services such as databases through Python code in the tool module, although the process runs in a sandbox. Version 2.3.1 fixes the issue...
EUVD-2025-175302
MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can access internal network services such as databases through Python code in the tool module, although the process runs in a sandbox. Version 2.3.1 fixes the issue...