QNAP QHora Operating System Command Injection Vulnerability

The QNAP QHora is a router from the Taiwan, China-based company Qualicom Technology QNAP. QNAP QHora suffers from an operating system command injection vulnerability that stems from the application's failure to properly filter constructed command special characters, commands, etc. No details of t...

PT-2025-54638

Name of the Vulnerable Software and Affected Versions Epson printer and scanner firmware Web Installer Epson printer driver installer Description The Epson Web Installer for printer and scanner firmware and the com.epson.InstallNavi.helper tool, included with the Epson printer driver installer,...

Messages Component Zero-Click Attack

The vulnerability of the Messages component in operating systems such as watchOS, macOS, iOS, and iPadOS is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to carry out a zero-click attack using a specially crafted iCloud link...

SMB Client Kernel Heap Buffer Overflow DoS

The vulnerability of the invalidateallcacheddirs function in the fs/smb/client/cacheddir.c module of the SMB client kernel for Linux operating systems is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentialit...

CVE-2025-52968

xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie...

Intel igb_clean_tx_ring Buffer Overflow DoS

Vulnerability of the igbcleantxring function in the drivers/net/ethernet/intel/igb/igbmain.c module – The driver for supporting Intel Ethernet network adapters in the Linux operating system is vulnerable due to the repeated use of previously freed memory. Exploiting this vulnerability can allow a...

Import from Excel Plugin Arbitrary Command Execution

The vulnerability of the plugin “Import from Excel. Uploading product catalogs for 1C-Bitrix” is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Multi-Functional Export/Import Excel Plugin Arbitrary Command Execution

The vulnerability of the “Multi-Functional Export/Import in Excel” plugin is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Storage Management Provider Unauthorized Access

The vulnerability of the Storage Management Provider component in Windows operating systems is related to reading data beyond the buffer limits of memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Grub2 hfs loader DoS

The vulnerability of the hfs loader component in the Grub operating system is related to writing beyond the boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure...

Windows Hello Biometric Authentication Unauthorized Access

The vulnerability of the biometric authentication function in Windows Hello on Windows operating systems is related to errors in information processing. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Windows DWM Unauthorized Access

The vulnerability of the Windows DWM library in Windows operating systems is related to the use of an uninitialized resource. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Grub2 FilesystemHandler DoS

The vulnerability of the fs FilesystemHandler component in the Grub operating system is related to writing beyond the boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure...

Grub2 Buffer Overflow DoS

The vulnerability of the operating system bootloader Grub is related to writing beyond the boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure...

Grub2 UFS DoS

The vulnerability of the UFS loader component in operating systems like Grub relates to writing beyond the boundary. Exploiting this vulnerability can allow an attacker to cause a service failure...

VulnCheck KEV: CVE-2025-34030

An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to t...

Exploit for CVE-2025-52969

ClickHouse Executable Table Abuse by Low Privilege User...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2025-0395...

CrafterCMS security vulnerability

CrafterCMS is a Java-based CMS from CrafterCMS, Inc. A security vulnerability exists in CrafterCMS versions 4.0.0 through 4.2.2 that stems from a Groovy sandbox bypass resulting in OS commands that can be executed by certified developers...

WeGIA operating system command injection vulnerability

WeGIA is a web manager for welfare organizations. WeGIA suffers from an operating system command injection vulnerability that stems from the branch parameter not being properly cleaned up in the /html/configuracao/debuginfo.php endpoint. An attacker could exploit this vulnerability to execute...