CVE-2025-26400

CVE-2025-26400 affects SolarWinds Web Help Desk. XXE vulnerability could lead to information disclosure; exploitation requires valid, low-privilege access unless the attacker has local server access to modify config files. Connected sources indicate affected versions before 12.8.7; remediation is...

PT-2025-31182 · Solarwinds · Solarwinds Web Help Desk

Name of the Vulnerable Software and Affected Versions: SolarWinds Web Help Desk affected versions not specified Description: SolarWinds Web Help Desk is susceptible to an XML External Entity XXE injection issue that may result in information disclosure. Successful exploitation requires valid,...

CVE-2025-26397

SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privileges can escalate privileges to run malicious files copied to a permission-protected folder. This vulnerability requires authentication fro...

CVE-2025-41678 SQL Injection via POST Requests Allowing Configuration Database Manipulation

A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement...

CVE-2025-24936

The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. An attacker with low privileged access to th...

CVE-2025-24938 Insufficient Validation of Input while user creation

The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access administrator to the application has the potential execute commands on the operating system under the context of the webserver. The vulnerable...

PT-2025-30234 · Nokia · Wavesuite Noc

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access...

Oracle Database Server (July 2025 CPU)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory. - Vulnerability in the Oracle Database component of Oracle Database Server. Supported versions that are affected are 19.3-19.27 and 23.4-23.8...

CVE-2025-53023

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Replication. Supported versions that are affected are 8.0.0-8.0.42. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attac...

CVE-2025-50089

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 9.0.0-9.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks ...

CBL Mariner 2.0 Security Update: mysql (CVE-2025-30689)

The version of mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30689 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions th...

CVE-2025-39202

CVE-2025-39202 concerns Hitachi MicroSCADA X SYS600, specifically the Monitor Pro interface. An authenticated user with low privileges can both view and overwrite files, enabling information disclosure and data corruption. Multiple connected sources (NVD, Red Hat, CIRCL, CISA ICS advisory, etc.) ...

CVE-2025-39202

A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can see and overwrite files causing information leak and data corruption...

Helmholz myREX24、MB Connect Line mymbCONNECT24和MB Connect Line mbCONNECT24 安全漏洞

MB Connect Line mbCONNECT24 and others are products of MB Connect Line, Germany.MB Connect Line mbCONNECT24 is a suite of remote service portals.MB Connect Line mymbCONNECT24 is an on-premise remote maintenance for virtual environments. Helmholz myREX24 and others are products of Helmholz. Helmho...

CVE-2025-49214

An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this...

CVE-2025-5141

A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager BoKS on versions 7.2.0 up to 7.2.0.17, 8.1.0 up to 8.1.0.22, 8.1.1 up to 8.1.1.7, 9.0.0 up to 9.0.0.1 and also legacy tar installs of BoKS 7.2 without hotfix 0474 on Linux, AIX, and Solaris allows low privilege...

CVE-2025-4680

Improper Input Validation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects upKeeper Instant Privilege Access: before 1.4.0...

CVE-2025-4681

Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Abuse.This issue affects upKeeper Instant Privilege Access: before 1.4.0...

CVE-2025-4681

CVE-2025-4681 affects upKeeper Instant Privilege Access (upKeeper). Root cause: improper privilege management leading to privilege abuse. Affected versions: before 1.4.0. Impact: high, with local attacker privilege escalation potential affecting confidentiality, integrity, and availability. Explo...

CVE-2025-4680

Improper Input Validation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects upKeeper Instant Privilege Access: before 1.4.0...