CVE-2024-48904

An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances. Please note: authentication is not required in order to exploit this vulnerability...

CVE-2025-0574

Sante PACS Server URL path Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2025-0573

Sante PACS Server DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2025-0569

Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2025-0568

Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw...

Apple iOS和iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS version 18.2 and iPadOS version 18.2, which originates from viewing photos in...

PT-2025-3992 · Beta10 · Beta10

Name of the Vulnerable Software and Affected Versions: Beta10 software affected versions not specified Description: The Beta10 software does not provide proper authorization control in multiple areas of the application, allowing a malicious actor to access private areas and/or areas intended for...

Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper...

NEC Aterm多款产品 访问控制错误漏洞

The NEC Aterm WF1200C and others are a wireless router from Nippon Electric NEC. An access control error vulnerability exists in various NEC Aterm products that stems from a lack of authentication for critical functions, allowing an attacker to obtain Wi-Fi passwords over the Internet. The...

CVE-2024-54764

An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication...

CVE-2024-54767

AVM FRITZ!Box 7530 AX (v7.59) is affected by an access control flaw in the /juis_boxinfo.xml endpoint that can disclose sensitive information without authentication. The issue appears to originate from improper access controls on the boxinfo endpoint, enabling unauthenticated information disclosu...

PT-2025-54482

Name of the Vulnerable Software and Affected Versions GNU Wget2 affected versions not specified Description GNU Wget2 contains a path traversal flaw when processing Metalink documents. The application does not properly validate file paths within the elements of Metalink v3/v4 documents. This allo...

CVE-2024-11946

iXsystems TrueNAS CORE fetchpluginpackagesites tar Cleartext Transmission of Sensitive Information Vulnerability. This vulnerability allows network-adjacent attackers to tamper with firmware update files on affected installations of iXsystems TrueNAS devices. Authentication is not required to...

CVE-2024-11944

iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. T...

OESA-2024-2585 libspf2 security update

libspf2 is an implementation of the SPF Sender Policy Framework specification as found at: http://www.ietf.org/internet-drafts/draft-mengwong-spf-00.txt SPF allows email systems to check SPF DNS records and make sure that an email is authorized by the administrator of the domain name that it is...

HomeGallery 安全漏洞

HomeGallery is a self-hosted open source web gallery from HomeGallery Open Source. It is used for browsing tagged, mobile-friendly, and AI-driven image discovery. A security vulnerability exists in HomeGallery version 1.15.0 and prior versions, which stems from default settings that do not have T...

PT-2024-35708 · Unknown · Home-Gallery.Org

Name of the Vulnerable Software and Affected Versions: Home-Gallery.org versions 1.15.0 and earlier Description: The default setup of Home-Gallery.org is vulnerable to DNS rebinding due to the lack of TLS and user authentication. An attacker can exploit this by changing the DNS records of their...

(0Day) Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the customhandler method. The issue results from the lack of...

The vulnerability of the StylemixThemes plugin in the eRoom – Zoom Meetings & Webinar system of the WordPress content management system, which allows a hacker to escalate their privileges.

The vulnerability of the StylemixThemes plugin in eRoom – a tool for Zoom meetings and webinars within the WordPress content management system – is related to the absence of authentication procedures. Exploiting this vulnerability could allow attackers to increase their privileges remotely...

CVE-2024-52592 Missing validation allows spoofed poll updates in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApInboxService.update allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instanc...