CVE-2025-46544

In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles...

Sherpa Orchestrator 安全漏洞

Sherpa Orchestrator is an IT management software from Sherpa for automating IT processes and workflow management. A security vulnerability exists in Sherpa Orchestrator version 141851, which stems from the possibility that a low-privileged user could elevate privileges by creating new users and...

CVE-2025-46544

CVE-2025-46544 affects Sherpa Orchestrator 141851. A low-privileged user can elevate privileges by creating new users and roles, as documented by multiple sources in connected documents. The vulnerability description is consistent across feeds; no exploits are provided in the documents. Some advi...

CVE-2025-1951 IBM Hardware Management Console - Power Systems command execution

IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands as a privileged user due to execution of commands with unnecessary privileges...

CVE-2025-1951

CVE-2025-1951 affects IBM Hardware Management Console (Power Systems) versions V10.2.1030.0 and V10.3.1050.0. The underlying issue is execution of commands with unnecessary privileges, enabling a local user to run commands as a privileged user (CWE-250). IBM’s advisory confirms the root cause as ...

CVE-2025-1981

Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready's Invoices module allows for SQL Injection attacks...

CVE-2025-1982

CVE-2025-1982 is a Local File Inclusion vulnerability in Ready’s attachment upload panel. The Red Hat CVE-2025-1982 entry confirms a low-privilege user can exploit a file:// link to read local system files, indicating a confidentiality impact. Connected RH entries also describe a related CVE-2025...

CVE-2025-1982 Local File Inclusion in Ready_

Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the file:// protocol thus allowing the attacker to read content of the file. This vulnerability can be use to read content of system files...

CVE-2025-1982 Local File Inclusion in Ready_

Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the file:// protocol thus allowing the attacker to read content of the file. This vulnerability can be use to read content of system files...

CVE-2025-1981 SQL Injection in Ready_

Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready's Invoices module allows for SQL Injection attacks...

CVE-2025-1981 SQL Injection in Ready_

Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready's Invoices module allows for SQL Injection attacks...

WAGO 输入验证错误漏洞

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. The device is specifically designed to operate electronic systems for digital computing applications in industrial environments. An input validation error vulnerability exists in WAGO that originates from a low-privileged...

PT-2025-16593 · Ready · Ready

Name of the Vulnerable Software and Affected Versions: Ready affected versions not specified Description: The issue allows a low-privileged user to provide a link to a local file using the file:// protocol, enabling the attacker to read the content of the file. This can be used to read the conten...

CVE-2025-31499

Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in FFmpeg. This can be leveraged to possibly achieve remote code execution by anyone with credentials to a low-privileged user. This vulnerability was previously reported in...

CVE-2025-0121

A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the agent. Additionally, malware can use this vulnerability to perform malicious activity without Cortex XDR being able to detect it...

CVE-2025-32383

MaxKB Max Knowledge Base is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation RAG. A reverse shell vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to create a reverse shell...

CVE-2025-30654

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the User Interface UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged, authenticated attacker with access to the CLI to access sensitive information. Through the execution of a specific...

CVE-2025-0121

A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the agent. Additionally, malware can use this vulnerability to perform malicious activity without Cortex XDR being able to detect it...

Palo Alto Networks Cortex XDR Agent 代码问题漏洞

Palo Alto Networks Cortex XDR Agent is an endpoint security software from Palo Alto Networks, USA. A security vulnerability exists in Palo Alto Networks Cortex XDR Agent that stems from a null pointer dereference that could cause a low-privileged user to crash the agent...

CVE-2025-27083

Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful exploitation of these vulnerabilities allows an Authenticated attacker to execute arbitrary commands as a privileged user on the underlying...