22791 matches found
CVE-2025-6436
Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 140 and Thunderbird 140...
CVE-2024-51980
An unauthenticated attacker may perform a limited server side request forgery SSRF, forcing the target device to open a TCP connection to an arbitrary port number on an arbitrary IP address. This SSRF leverages the WS-Addressing ReplyTo element in a Web service HTTP TCP port 80 SOAP request. The...
CVE-2024-51978
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP...
CVE-2024-51979
An authenticated attacker may trigger a stack based buffer overflow by performing a malformed request to either the HTTP service TCP port 80, the HTTPS service TCP port 443, or the IPP service TCP port 631. The malformed request will contain an empty Origin header value and a malformed Referer...
CVE-2024-51978
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP...
CVE-2024-51977
An unauthenticated attacker who can access either the HTTP service TCP port 80, the HTTPS service TCP port 443, or the IPP service TCP port 631, can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mntinfo.csv can be accessed via a GET request and no...
CVE-2024-51977
An unauthenticated attacker who can access either the HTTP service TCP port 80, the HTTPS service TCP port 443, or the IPP service TCP port 631, can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mntinfo.csv can be accessed via a GET request and no...
CVE-2024-51979
creationtimestamp| type| source ---|---|--- 2025-06-25 07:50:12+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19425 2025-06-25 12:32:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsgmlobh7b2i 2025-06-27 13:35:46+00:00| seen|...
EUVD-2024-54698
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP...
CVE-2024-51977
CVE-2024-51977 affects at least one Brother multi‑function device (notably the MFC‑L9570CDW) where an unauthenticated attacker can reach the HTTP/HTTPS/IPP services on ports 80/443/631 and retrieve /etc/mnt_info.csv. The CSV exposes device info including model, firmware version, IP address, and s...
CVE-2024-51977 Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.
An unauthenticated attacker who can access either the HTTP service TCP port 80, the HTTPS service TCP port 443, or the IPP service TCP port 631, can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mntinfo.csv can be accessed via a GET request and no...
kernel: idpf: check error for register_netdev() on init
In the Linux kernel, the following vulnerability has been resolved: idpf: check error for registernetdev on init Current init logic ignores the error code from registernetdev, which will cause WARNON on attempt to unregister it, if there was one, and there is no info for the user that the creatio...
CVE-2025-5987
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with th...
Fedora 42 : dotnet8.0 (2025-fa1fdd193f)
The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-fa1fdd193f advisory. This is the June 2025 monthly update for .NET 8. Release Notes: - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.17/8.0.117.md - Runtime...
Brother Industries Multiple driver installers for Windows 安全漏洞
Brother Industries Multiple driver installers for Windows is a driver software from Brother Industries, Japan. A security vulnerability exists in Brother Industries Multiple driver installers for Windows, which can be exploited by an unauthenticated attacker to generate a default administrator...
Multiple Brother devices authentication bypass via default administrator password generation
By leaking a target devices serial number, a remote attacker can generate the target devices default administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests. Module Options msf use...
CVE-2025-4383
creationtimestamp| type| source ---|---|--- 2025-06-24 15:47:05+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19362 2025-06-24 17:19:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsem5v7mzw2a...
CVE-2025-6568
The CVE-2025-6568 affects TOTOLINK EX1200T, specifically the HTTP POST Request Handler at /boafrm/formIpv6Setup. The vulnerability arises from improper handling of the submit-url argument, causing a buffer overflow that can be triggered remotely. Affects version 4.1.2cu.5232_B20210713; exploitati...
CVE-2025-6430 Content-Disposition header ignored when a file is included in an embed or object tag
When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a embed or object tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12,...
CVE-2025-52570
creationtimestamp| type| source ---|---|--- 2025-06-24 03:48:13+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19298 2025-06-24 06:18:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsdh7jg53c25 2025-06-30 19:57:35+00:00| seen|...