VulnCheck KEV: CVE-2024-8852

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full...

CVE-2025-59373

A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM. For more...

CVE-2025-66269

The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a local attacker to perform path interception and escalate privileges if they have write permissions to the directories proceeding that of which the real service executables...

The vulnerability of the software for the training and control system “OLIMPOKS: Enterprise” arises from improper external management of file names or paths, allowing a perpetrator to gain unauthorized access to protected information.

The vulnerability of the software for the training and control system “OLIMPOKS: Enterprise” is related to improper external management of file names or file paths. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2025-66035 Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential...

CVE-2025-13596

A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When certain unexpected conditions trigger unhandled exceptions, the application returns detailed error messages and stack traces to the client...

EUVD-2025-199687

The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a local attacker to perform path interception and escalate privileges if they have write permissions to the directories proceeding that of which the real service executables...

PT-2025-48123

The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a local attacker to perform path interception and escalate privileges if they have write permissions to the directories proceeding that of which the real service executables...

The vulnerability of the software for collecting and processing data related to technological processes in ABB Ability Edgenius allows attackers to bypass authentication mechanisms through alternative paths or channels, enabling them to circumvent existing security measures.

The vulnerability of the ABB Ability Edgenius software for collecting and processing data related to technological processes involves bypassing authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms...

CVE-2025-59373

A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM. For more...

CVE-2025-59373

A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM. For more...

CVE-2025-59373

CVE-2025-59373 concerns a local privilege escalation in the ASUS System Control Interface (ASCI) restore mechanism, enabling an unprivileged user to copy files into protected system paths and cause arbitrary code to run as SYSTEM. Several sources (NVD/NIST, Red Hat, CIRCL enrichment, ZDI) identif...

CVE-2025-59373

A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM. For more...

EUVD-2025-199530

A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM. For more...

EUVD-2024-55101

In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks. An adversary can place an executable in a higher-level directory of the path, and Windows will resolve tha...

EUVD-2025-199382

Malicious code in @voiceflow/tsconfig-paths npm...

Malicious code in @voiceflow/tsconfig-paths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb7c02b11afed895db4edc03c6318bb09005f30253dcea72d4d1b0876478212 The package @voiceflow/tsconfig-paths was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191380 Malicious code in @voiceflow/tsconfig-paths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb7c02b11afed895db4edc03c6318bb09005f30253dcea72d4d1b0876478212 The package @voiceflow/tsconfig-paths was found to contain malicious code. Source: google-open-source-security...

ROS-20251125-13

A vulnerability in the maskedPaths feature of the isolated container runc tool is related to the runc state that allows link tracking. Exploitation of the vulnerability could allow an attacker to Affect the confidentiality, integrity and availability of protected information...

PT-2025-48076

Name of the Vulnerable Software and Affected Versions UnForm Server versions prior to 10.1.15 Description UnForm Server versions prior to 10.1.15 have an unauthenticated arbitrary file read and SMB coercion issue in the Doc Flow feature’s arc endpoint. The Doc Flow module uses the arc handler to...