PT-2025-32865 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.4-p14 and earlier Adobe Commerce versions 2.4.5-p13 and earlier Adobe Commerce versions 2.4.6-p11 and earlier Adobe Commerce versions 2.4.7-p6 and earlier Adobe Commerce versions 2.4.8-p1 and earlier Adobe Commerce...

The vulnerability of the Vagrant VMWare Utility service lies in the improper assignment of permissions to the critical resource, allowing an attacker to gain read and modify access to files.

The vulnerability of the Vagrant VMWare Utility relates to the improper assignment of permissions for the critical resource. Exploiting this vulnerability can allow an attacker to gain read and write access to files...

net/mdiobus: Fix potential out-of-bounds read/write access

...

net/mdiobus: Fix potential out-of-bounds clause 45 read/write access

...

CVE-2025-44962

RUCKUS SmartZone SZ before 6.1.2p3 Refresh Build allows ../ directory traversal to read files...

CVE-2025-4130

Use of Hard-coded Credentials vulnerability in PAVO Inc. PAVO Pay allows Read Sensitive Constants Within an Executable. This issue affects PAVO Pay: before 13.05.2025...

The vulnerability of the Internal Operations component of the Oracle Lease and Finance Management system, a business automation solution, allows a perpetrator to gain access to read, modify, and delete information.

The vulnerability of the Internal Operations component of the Oracle Lease and Finance Management system, a part of the Oracle E-Business Suite, relates to deficiencies in the authorization process. Exploiting this vulnerability could allow an attacker to gain access to read, modify, and delete...

The vulnerability of the SFTP service in the microsoftware for digital optical network systems Infinera G42 allows a hacker to gain read and write access to arbitrary files.

The vulnerability of the SFTP service in the microsoftware for Digital Optical Networking Systems Infinera G42 is related to improper handling of insufficient permissions or privileges. Exploiting this vulnerability can allow a malicious actor to gain read and write access to arbitrary files...

The vulnerability of the Preferences component of the Oracle CRM system’s customer relationship management module. The Oracle E-Business Suite technical foundation for automating business processes, allowing attackers to gain access to read, modify, and delete information.

The vulnerability of the Preferences component of the Oracle CRM system’s customer relationship management module is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain read, modify, and delete access to information...

The vulnerability of the Web Runtime SEC component of the JD Edwards EnterpriseOne Tools system for resource management allows a perpetrator to gain access to read, modify, and delete information.

The vulnerability of the Web Runtime SEC component of the JD Edwards EnterpriseOne Tools system for resource management involves security segmentation flaws. Exploiting this vulnerability could allow an attacker to gain read, modify, and delete access to information...

The vulnerability of the PIA Core Technology component of the Oracle PeopleSoft Enterprise PeopleTools business application suite allows a hacker to gain read, modify, and delete access to data.

The vulnerability of the PIA Core Technology component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain read, modify, and delete access to data...

UBUNTU-CVE-2025-53029

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle ...

CVE-2025-52082

In Netgear XR300 V1.0.3.3810.3.30, a stack-based buffer overflow exists in the HTTPD service through the usbdevice.cgi endpoint. The vulnerability occurs when processing POST requests containing the readaccess parameter...

Ansible-core: ansible-core user may read/write unauthorized content

...

FileBrowser Command Injection Vulnerability

FileBrowser is an open source web file browser . Provides a file management interface in a specified directory , can be used to upload , delete , preview , rename and edit your files . FileBrowser has a command injection vulnerability that can be exploited by an attacker to gain read and write...

The vulnerability of the Nix, Lix, and Guix package managers lies in synchronization errors when using a shared resource, allowing an attacker to gain read and write access to data.

The vulnerability of the Nix, Lix, and Guix package managers is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain access to read and modify data...

kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider

A flaw was found in Apache Kafka Clients. Apache Kafka Clients accepts configuration data for customizing behavior and includes ConfigProvider plugins to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider...

Exploit for CVE-2025-30208

🔥 CVE-2025-30208 Vite Arbitrary File Read Vulnerability Scanne...

Directory Traversal

Overview langchain-chatchat is a Langchain-Chatchat formerly langchain-ChatGLM, local knowledge based LLM like ChatGLM, Qwen and Llama RAG and Agent app with langchain Affected versions of this package are vulnerable to Directory Traversal via the flag argument in /v1/file. An attacker can access...

GHSA-JJ2R-455P-5GVF filebrowser Sets Insecure File Permissions

Summary The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers where the umask configuration has not been hardened before, this makes all the stated fil...