CVE-2019-14239

On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls FAC a software IP protection method for execute-only access can be defeated by leveraging a load instruction inside the execute-only region to expose the protected code into a CPU register...

CVE-2011-4703

The Limit My Call com.limited.call.view application 2.11 for Android does not properly protect data, which allows remote attackers to read or modify call logs and a contact list via a crafted application...

CVE-2025-2247 WP-PManager <= 1.2 - Category Deletion via CSRF

The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Ubuntu: Security Advisory (USN-7459-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-0618

A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamper protection event to the HX service to trigger an exception. This exception will prevent any further tamper protection events from being processed, even afte...

CVE-2025-0618

CVE-2025-0618 affects Trellix Endpoint Security (HX) Server versions 10.0.2 and earlier. A specially crafted tamper protection event can trigger an unhandled exception in the HX service, causing a persistent denial of service that prevents processing of any further tamper protection events, even ...

The vulnerability of the Kubernetes cluster deployment and management software on Azure Local Cluster infrastructure lies in the insufficient protection of registration data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Kubernetes cluster deployment and management software on Azure Local Cluster infrastructure is related to insufficient protection for registration data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

CVE-2025-29929 Tuleap is missing CSRF protection on tracker hierarchy administration

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy administration. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. This...

CVE-2022-49760 mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix PTE marker handling in hugetlbchangeprotection Patch series "mm/hugetlb: uffd-wp fixes for hugetlbchangeprotection". Playing with virtio-mem and background snapshots using uffd-wp on hugetlb in QEMU, I managed to...

Advisory ROSA-SA-2025-2762

Software: python-jinja2 2.7.2 OS: rosa-server79 packageevrstring: python-jinja2-2.7.2-4.0.1.res7 CVE-ID: CVE-2024-56326 BDU-ID: 2025-00113 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the str.format method of the jinja html templating tool is related to the failure to neutralize special element...

CVE-2024-56140

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. However, a vulnerability...

The vulnerability of Spam protection, AntiSpam, and FireWall modules in the CleanTalk plugin for WordPress website content management systems arises from improper handling of exceptional states, allowing attackers to execute arbitrary code.

The vulnerability of Spam protection, AntiSpam, and FireWall modules in the CleanTalk plugin for WordPress website content management systems is related to improper handling of exceptional states. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2020-11919

A cross-site request forgery (CSRF) vulnerability was identified in the Siime Eye smart home device, specifically affecting version 14.1.00000001.3.330.0.0.3.14 . The root cause is a lack of CSRF protection within the software. This issue reportedly impacts multiple brands, including Epson, Sannc...

FESTO Didactic CP, MPS 200, and MPS 400 Firmware

GENERAL RECOMMENDATIONS As part of a security strategy, Festo recommends the following general defense measures to reduce the risk of exploits: - Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. - Use...

Dell PowerProtect Data Domain Server-Side Request Forgery Vulnerability

Dell PowerProtect Data Domain is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell USA. A server-side request forgery vulnerability exists in Dell PowerProtect Data Domain, which could be exploited by an attacker to cause information disclosure in an...

Proofpoint Enterprise Protection 代码问题漏洞

Proofpoint Enterprise Protection is an application from Proofpoint, Inc. It provides functionality to protect e-mail. A code issue vulnerability exists in Proofpoint Enterprise Protection that stems from the presence of a server-side request forgery vulnerability...

The vulnerability of the HP Print and Scan Doctor for Windows diagnostic tool lies in the insufficient protection of operational data, which allows attackers to exploit their privileges.

The vulnerability of the HP Print and Scan Doctor for Windows diagnostic tool is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow attackers to gain increased privileges...

The vulnerability of the Microsoft Visual Studio software development tool, related to insufficient protection of sensitive data, allows attackers to disclose protected information.

The vulnerability of the Microsoft Visual Studio software relates to insufficient protection of sensitive data. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent and Acronis CyberProtect 15 software lies in the lack of protection for operational data, allowing attackers to access confidential information.

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent and Acronis CyberProtect 15 data protection software lies in the lack of protection for operational data. Exploiting this vulnerability can allow unauthorized actors to gain access to confidential...

The vulnerability of the protection mechanism of the network traffic analysis, network detection, and response software Cortex XDR Agent for Windows operating systems allows attackers to disable the Cortex XDR Agent.

The vulnerability of the protection mechanism for network traffic analysis, network detection, and response in the Cortex XDR Agent for Windows operating systems is related to improper handling of exceptional states. Exploiting this vulnerability can allow attackers to disable the Cortex XDR Agen...