3873 matches found
CVE-2025-31247
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An attacker may gain access to protected parts of the file system...
CVE-2025-4555
CVE-2025-4555 concerns the web management interface of Okcat Parking Management Platform (ZONG YU), where a Missing Authentication vulnerability allows unauthenticated remote attackers to directly access system functions. Multiple connected sources describe the impact as enabling actions such as ...
Apple macOS 安全漏洞
Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS that originates from possible access to protected portions of the file system...
PT-2025-20791 · Apple · Macos Sonoma +3
Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.7.6 macOS Sequoia versions prior to 15.5 macOS Sonoma versions prior to 14.7.6 Description: A logic issue was addressed with improved state management, which could allow an attacker to gain access to protect...
CVE-2025-4377
Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem. Logview is accessible on Pro Cloud Server Configuration interface. This issue affects Pr...
CVE-2024-13962 Link Following Local Privilege Escalation Vulnerability in Avast Cleanup Premium Version 24.2.16593.17810
Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Gen Digital Inc. Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveragi...
CVE-2025-4377
Sparx Systems Pro Cloud Server is affected by CVE-2025-4377 due to an Improper Limitation of a Pathname in logview.php, enabling a Path Traversal that allows reading arbitrary files on the filesystem. The issue affects Pro Cloud Server versions earlier than 6.0.165 and is exposed via the Pro Clou...
firefox: thunderbird: Privilege escalation in Firefox Updater
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the...
firefox: thunderbird: Privilege escalation in Firefox Updater
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the...
gvfs bug fix update
An update is available for gvfs. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GVFS is the GNOME Desktop Virtual File System layer that allows users to easily...
CVE-2025-20199
Cisco IOS XE Software contains a privilege-escalation vulnerability in the CLI that could allow an authenticated local attacker with privilege level 15 to gain root access on the device’s underlying OS. The issue stems from insufficient input validation when processing certain configuration comma...
The vulnerability of the Delphix Continuous Data and Delphix Continuous Compliance data management tools lies in improper privilege assignment, allowing attackers to gain control over the command line of the operating system.
The vulnerability of the Delphix Continuous Data data management software is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to gain control over the command line of the operating system...
CVE-2025-2817
Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations...
UBUNTU-CVE-2025-2817
Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file...
CVE-2025-34489
GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a crafted serialized payload to a .NET Remoting Service...
Daikin Security Gateway v214 Remote Password Reset
Summary The Security gateway allows the iTM and LC8 controllers to connect through the Security gateway to the Daikin Cloud Service. Instead of sending the report to the router directly, the iTM or LC8 controller sends the report to the Security gateway first. The Security gateway transforms the...
PT-2025-17736 · Unknown · Online Class/Exam Scheduling System
Name of the Vulnerable Software and Affected Versions: Online Class and Exam Scheduling System version 1.0 Description: A vulnerability has been discovered in the code, affecting some unknown features in the file /Scheduling/pages/class sched.php. Manipulating the class parameter can lead to...
User Profiles: the Achilles' Heel of Web Browsers
Web browsers provide the security foundation for our online experiences. Significant research has been done into the security of browsers themselves, but relatively little investigation has been done into how they interact with the operating system or the file system. In this work, we provide the...
Arbitrary File Disclosure
Vite is vulnerable to Arbitrary File Disclosure. The vulnerability is due to incorrect assumptions about the presence of in req.url, which is permitted by some runtimes Node, Bun despite being invalid per HTTP specs, allowing attackers to bypass file system access restrictions using path traversa...
