Poppler 资源管理错误漏洞

Poppler is a PDF rendering library from Poppler open source. A resource management error vulnerability exists in versions of Poppler prior to 25.10.0, which stems from the use of raw pointers to std::vector elements in the StructTreeRoot class, which could lead to reuse after release...

CVE-2025-61926 Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret

Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary an...

CVE-2025-61601 BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation

BigBlueButton is an open-source virtual classroom. A Denial of Service DoS vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's Choices response type. By submitting a malicious payload with a massive array in...

CVE-2025-55200

BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the "Shared Notes" feature contains a Stored Cross-Site Scripting XSS vulnerability with the input location being the "Username" field and the output location on the "Shared Notes" page, when a user with a malicious...

EUVD-2025-33377

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Discovery page that, when visited by another user, enables the attacker to execute commands with the target's...

EUVD-2025-33388

A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify metadata via the web interface. Tampering with this metadata can result in managed SRX Series devices permitting network traffic that...

CVE-2025-59999

CVE-2025-59999 affects Juniper Networks Junos Space; the issue is an Improper Neutralization of Input During Web Page Generation (XSS) that allows an attacker to inject script tags into the API Access Profiles page. When other users visit the page, the attacker may execute commands with the targe...

CVE-2025-59993 Junos Space: Space Node Setting fields are vulnerable to reflected cross-site script injection

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Space Node Setting fields that, when visited by another user, enable the attacker to execute commands with the target...

CVE-2025-59984 Junos Space: Global Search is vulnerable to reflected cross-site script injection

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in Global Search that, when visited by another user, enables the attacker to execute commands with the target's permissions,...

CVE-2025-59983 Junos Space: Template Definition page is vulnerable to reflected cross-site script injection

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Template Definition page, when visited by another user, enables the attacker to execute commands with the target's...

CVE-2025-59982

CVE-2025-59982 affects Juniper Networks Junos Space prior to 24.1R4. Affected component: web page generation for the dashboard/search input. Root cause: improper input neutralization allows cross-site scripting (reflected) that can inject script tags; when visited by another user, it can execute ...

CVE-2025-59974 Junos Space Security Director: Persistent Cross-Site Scripting (XSS) vulnerability

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Junos Space Security Director allows an attacker to inject malicious scripts into the application, which are then stored and executed in the context of other users' browsers when they access...

CVE-2025-59968

CVE-2025-59968 concerns Juniper Networks Junos Space Security Director where a Missing Authorization flaw allows an unauthenticated remote attacker to read or modify metadata via the web interface. Tampering with metadata could cause managed SRX Series devices to permit traffic that should be blo...

CVE-2025-10239

In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interface to execute additional unintended commands within scripts intended for troubleshooting purposes...

PT-2025-41349

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-47342 Description A temporary denial-of-service condition might happen when multiple profiles are used at the same time with QHS enabled. Recommendations At the moment, there is no information about a newer version that...

PT-2025-41378

Name of the Vulnerable Software and Affected Versions Flowmon versions prior to 12.5.5 Description Flowmon network monitoring solutions are affected by an issue that allows an authenticated administrator to execute additional unintended commands within scripts designed for troubleshooting. This...

PT-2025-41398

Name of the Vulnerable Software and Affected Versions Juniper Networks Security Director Policy Enforcer versions prior to 23.1R1 Hotpatch v3 Description A missing authentication check for a critical function in Juniper Networks Security Director Policy Enforcer allows an unauthenticated,...

PT-2025-41343

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-27054 Description A memory corruption issue exists when processing a malformed license file during reboot. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

Better Auth 安全漏洞

Better Auth is a TypeScript's most comprehensive authentication framework open-sourced by Better Auth. A security vulnerability exists in versions of Better Auth prior to 1.3.26 that originates from an unauthenticated attacker who can bypass authentication via the user ID in the request body,...

Juniper Junos OS Evolved 代码问题漏洞

Juniper Junos OS Evolved is a network operating system from Juniper USA. A code issue vulnerability exists in Juniper Junos OS Evolved versions prior to 22.4R3-EVO and 23.2 to prior to 23.2R2-EVO, which arises from not properly checking for an exception condition that could result in...