Do Not Enable the TFTP Service

Trivial File Transfer Protocol TFTP is used for file transfer between a Linux server and other servers, desktop systems, as well as terminal devices. TFTP does not support authentication and encryption mechanisms. Data tends to be forged, tampered with, or stolen by attackers during communication...

CVE-2025-9983 Lack of Authentication for RTSP stream

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior. The vendor did not respond in any way. Only...

CVE-2025-54754

An attacker with adjacent access, without authentication, can exploit this vulnerability to retrieve a hard-coded password embedded in publicly available software. This password can then be used to decrypt sensitive network traffic, affecting the Cognex device...

CVE-2025-54754

CVE-2025-54754 affects Cognex In-Sight Explorer and In-Sight Camera firmware. The vulnerability arises from a hard-coded password embedded in publicly available software, which an adjacent attacker with no authentication can retrieve to decrypt sensitive network traffic on Cognex devices. Documen...

CVE-2025-54754 Cognex In-Sight Explorer and In-Sight Camera Firmware Use of Hard-coded Password

An attacker with adjacent access, without authentication, can exploit this vulnerability to retrieve a hard-coded password embedded in publicly available software. This password can then be used to decrypt sensitive network traffic, affecting the Cognex device...

PT-2025-38486

Name of the Vulnerable Software and Affected Versions Cognex device affected versions not specified Description An attacker with adjacent access, without authentication, can retrieve a hard-coded password embedded in the software. This password can be used to decrypt sensitive network traffic...

CVE-2025-57176

On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption metadata only with file contents...

CVE-2009-20007

Talkative IRC v0.4.4.16 is vulnerable to a stack-based buffer overflow when processing specially crafted response strings, caused by a fixed-length buffer overflow. An attacker can remotely exploit this without authentication to potentially execute arbitrary code in the vulnerable process. Public...

CVE-2009-20007 Talkative IRC v0.4.4.16 Response Buffer Overflow

Talkative IRC v0.4.4.16 is vulnerable to a stack-based buffer overflow when processing specially crafted response strings sent to a connected client. An attacker can exploit this flaw by sending an overly long message that overflows a fixed-length buffer, potentially leading to arbitrary code...

CVE-2025-10016 Local Privilege Escalation in Sparkle Autoupdate Daemon

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...

CVE-2025-10016 Local Privilege Escalation in Sparkle Autoupdate Daemon

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege...

PT-2025-38003

Name of the Vulnerable Software and Affected Versions: Talkative IRC version 0.4.4.16 Description: Talkative IRC version 0.4.4.16 is susceptible to a stack-based buffer overflow when handling specially crafted response strings received from a connected client. An attacker can exploit this issue b...

CVE-2025-57176

On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption metadata only with file contents...

CVE-2025-56578

An issue in RTSPtoWeb v.2.4.3 allows a remote attacker to obtain sensitive information and executearbitrary code via the lack of authentication mechanisms...

CVE-2025-56578

RTSPtoWeb v2.4.3 contains a lack of authentication that allows a remote attacker to both disclose sensitive information and execute arbitrary code. Affected software: RTSPtoWeb 2.4.3. Root cause: missing authentication mechanisms. Impact: confidentiality loss and potential code execution; CVSS 3....

RTSPtoWeb 安全漏洞

RTSPtoWeb is an RTSP to Web converter by the individual developer Andrey Semochkin. A security vulnerability exists in RTSPtoWeb version 2.4.3, which stems from the lack of an authentication mechanism and could lead to the disclosure of sensitive information and the execution of arbitrary code...

MCP MariaDB Server 安全漏洞

MCP MariaDB Server is an open source server implementation of the Large Language Model Context Protocol for MariaDB. A security vulnerability exists in MCP MariaDB Server version 0.1.0, which stems from a lack of user authentication for the SSE service and could lead to the disclosure of sensitiv...

CVE-2025-56578

An issue in RTSPtoWeb v.2.4.3 allows a remote attacker to obtain sensitive information and executearbitrary code via the lack of authentication mechanisms...

CVE-2025-9994

The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with network access...

CVE-2025-9994 Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not require authentication

The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with network access...