CVE-2025-30260 Qsync Central

An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We hav...

QNAP File Station 5 安全漏洞

QNAP Systems File Station 5威联通QNAP presents a file management application for browsing, uploading, downloading and managing files and folders stored on NAS devices, remote servers or external storage devices. An unrestricted resource allocation vulnerability exists in QNAP Systems File Station 5,...

QNAP Qsync Central 安全漏洞

QNAP Qsync Central is a private cloud synchronization service launched by QNAP, which is mainly used to achieve real-time synchronization and backup of files between devices. An unrestricted resource allocation vulnerability exists in QNAP Qsync Central, which can be exploited by an attacker to...

CVE-2025-1139 IBM Edge Application Manager incorrect permissions

IBM Edge Application Manager 4.5 could allow a local user to read or modify resources that they should not have authorization to access due to incorrect permission assignment...

CVE-2025-1139

CVE-2025-1139 affects IBM Edge Application Manager 4.5. A local user can read or modify resources due to incorrect permission assignment. Root cause: improper/incorrect permission provisioning. Impact: unauthorized access to resources on the device. Mitigation: upgrade to patched IBM Edge Applica...

CVE-2025-55306

GenXFX is an advance IA trading platform that will focus on forex trading. A vulnerability was identified in the GenX FX backend where API keys and authentication tokens may be exposed if environment variables are misconfigured. Unauthorized users could gain access to cloud resources Google Cloud...

CVE-2025-49743

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...

CVE-2025-8660

Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed...

CVE-2025-50176

Access of resource using incompatible type 'type confusion' in Graphics Kernel allows an authorized attacker to execute code locally...

Windows Push Notifications Apps Elevation of Privilege Vulnerability

Access of resource using incompatible type 'type confusion' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

PT-2025-32844 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel affected versions not specified Description: Access of a resource using an incompatible type 'type confusion' in Microsoft Office Excel allows an unauthorized attacker to execute code locally. The vulnerability allows...

CVE-2025-8660

Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed...

Huawei EulerOS: Security Advisory for wget (EulerOS-SA-2025-1736)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Improper Authorization

@haxtheweb/haxcms-nodejs and elmsln/haxcms are vulnerable to Improper Authorization. The vulnerability is due to failure to verify if an authenticated user has permission to interact with a resource before performing operations...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the URL validation process. An attacker can access internal or otherwise restricted resources by submitting a specially crafted URL that bypasses configured allowlists. Remediation Upgrade...

CVE-2025-23285

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where it allows a guest to access global resources. A successful exploit of this vulnerability might lead to denial of service...

tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources

A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths...

GLPI 安全漏洞

GLPI is a free asset and IT management software suite. A security vulnerability exists in GLPI versions 0.80 through 10.0.18, which originates from the system not validating permissions on some resource access requests. An attacker could exploit the vulnerability to gain unauthorized access to...

CVE-2025-6504

HDP Server on Linux versions prior to 4.6.2.2978 is vulnerable to IP-spoofing via the X-Forwarded-For header. Because XFF is client-controlled, a spoofed address that matches a whitelisted range can bypass IP-based access controls, potentially allowing unauthorized access. Exploitation still requ...

tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources

A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths...