CVE-2025-26354

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua copy endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...

CVE-2025-26349

A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests...

CVE-2025-26356

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua setActive endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...

CVE-2025-26354

CVE-2025-26354 concerns Q-Free MaxTime

CVE-2025-26354

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua copy endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...

CVE-2023-31345

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...

Q-Free MAXTIME Suite security vulnerabilities

Q-Free MAXTIME Suite is a software suite for local traffic signal management from Q-Free. A security vulnerability exists in Q-Free MAXTIME Suite version 2.11.0 and prior versions. An attacker could exploit the vulnerability to overwrite sensitive files via a specially crafted HTTP request...

Q-Free MAXTIME Suite security vulnerabilities

Q-Free MAXTIME Suite is a software suite for local traffic signal management from Q-Free. A security vulnerability exists in Q-Free MAXTIME Suite version 2.11.0 and prior versions. An attacker could exploit the vulnerability to overwrite sensitive files via a specially crafted HTTP request...

PT-2025-7057 · Nitrokey · Nitrokey 3 Firmware

Name of the Vulnerable Software and Affected Versions: Nitrokey 3 Firmware versions 1.8.0 and prior test releases with PIV enabled Description: The PIV application in the Nitrokey 3 Firmware could accept invalid keys for authentication of the admin key, potentially compromising the integrity of t...

CVE-2025-26354: Path Traversal: '.../...//'

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua copy endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...

CVE-2025-26356: Path Traversal: '.../...//'

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua setActive endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...

CVE-2025-26349: Relative Path Traversal

A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests...

CVE-2023-31345: Improper Access Control for Volatile Memory Containing Boot Code

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...

CVE-2025-25201: Improper Authentication

Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could accept invalid keys for authentication of the admin key. This could lead to compromise of the integrity of the data stored in the...

CVE-2023-31345

CVE-2023-31345 is an AMD SMM-handling vulnerability in AMD Secure Processor firmware. The issue stems from improper input validation in the SMM handler, which could allow a privileged attacker to overwrite SMRAM and potentially achieve arbitrary code execution. Affected context is AMD client/serv...

CVE-2023-31343

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...

CVE-2023-31343

Summary: CVE-2023-31343 is an AMD processor firmware vulnerability in the System Management Mode (SMM) handler. Connected sources describe improper input validation in the SMM handler that could let a privileged attacker overwrite SMRAM, potentially enabling arbitrary code execution on affected s...

CVE-2023-31342

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...

CVE-2023-31342

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...

CVE-2023-31342

CVE-2023-31342 corresponds to an AMD SMM handler weakness where improper input validation can enable a privileged attacker to overwrite SMRAM, potentially enabling arbitrary code execution. The vulnerability is associated with AMD Secure Processor and related platform firmware. Affected detail fr...