29607 matches found
Cisco IOS XE Software Secure Boot Bypass (cisco-sa-secboot-UqFD8AvC)
According to its self-reported version, Cisco IOS-XE Software is affected by multiple vulnerabilities. - Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to the device to...
CVE-2025-56146
Indian Bank IndSMART Android App 3.8.1 is vulnerable to Missing SSL Certificate Validation in NuWebViewActivity...
curl: CVE-2025-10966: missing SFTP host verification with wolfSSH
Summary: When curl is built with the wolfSSH backend, the SSH/SFTP implementation in lib/vssh/wolfssh.c performs no server host key verification and exposes no host identity options in the curl tool. I verified this locally by building curl with wolfSSH binary reports wolfssh/1.4.20, observing th...
September 23, 2025âKB5065790 (OS Build 22631.5984) Preview
None None...
PT-2025-39203
Name of the Vulnerable Software and Affected Versions Indian Bank IndSMART Android App version 3.8.1 Description The Indian Bank IndSMART Android App version 3.8.1 exhibits a flaw related to missing SSL certificate validation within the NuWebViewActivity component. This could potentially allow fo...
Do Not Enable the TFTP Service
Trivial File Transfer Protocol TFTP is used for file transfer between a Linux server and other servers, desktop systems, as well as terminal devices. TFTP does not support authentication and encryption mechanisms. Data tends to be forged, tampered with, or stolen by attackers during communication...
CVE-2025-57602
Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH private key, allows remote attackers to authenticate to the cloud controller, gain interactive shell access, and pivot into other connected IoT devices. This can...
CVE-2025-35041 Airship AI Acropolis MFA insufficient rate limiting
Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9...
Security update for wireshark
This update for wireshark fixes the following issues: Update to version 4.2.13. Security issues fixed: CVE-2025-9817: SSH dissector crash due to NULL pointer dereference when processing malformed packet traces bsc1249090. Other issues fixed: Bug in UDS dissector with Service...
[SECURITY] Fedora 42 Update: podman-tui-1.8.0-1.fc42
podman-tui is a terminal user interface for Podman v4 and v5. podman-tui is using podman.socket service to communicate with podman environm ent and SSH to connect to remote podman machines...
security-guide-for-developers
This is a security guide for web developers, covering various security topics such as authentication, authorization, data validation, and encryption. The guide is divided into several sections, including a security checklist, authentication and authorization, data validation and sanitation, and...
The vulnerability of the SSH protocol implementation in software for controlling traffic lights with Q-Free MaxTime allows a intruder to increase their privileges and execute arbitrary code.
The vulnerability of the SSH protocol implementation in software for controlling traffic lights with Q-Free MaxTime lies in the use of strictly encrypted login credentials. Exploiting this vulnerability allows a malicious actor to increase their privileges and execute arbitrary code remotely...
ProFTPD Detection Consolidation
Consolidation of ProFTPD detections. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.155379";...
September 22, 2025âKB5068221 (OS Build 26100.6588) Out-of-band
None None...
CVE-2025-57602
Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH private key, allows remote attackers to authenticate to the cloud controller, gain interactive shell access, and pivot into other connected IoT devices. This can...
sslyze
It is an offensive tool for scanning SSL/TLS configurations. The primary target of this tool is the SSL/TLS configuration of a server, which can be analyzed to ensure it uses strong encryption settings and is not vulnerable to known TLS attacks. The tool can connect to a server to perform the...
Static Security Vulnerability Scanning of Proprietary and Open-Source Software: an Adaptable Process with Variants and Results
Software vulnerabilities remain a significant risk factor in achieving security objectives within software development organizations. This is especially true where either proprietary or open-source software OSS is included in the technological environment. In this paper an end-to-end process with...
rubysec
This is a Ruby library for performing mutation testing, which is a form of testing that ensures that test coverage is comprehensive by introducing small changes mutations into the code under test and verifying that the tests fail as expected. The library, called Mutant, is designed to be used in...
CVE-2025-10305 Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion
The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the deletepasskey and passkeyslist function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...
CVE-2025-10305
CVE-2025-10305 documents a vulnerability in the WordPress Secure Passkeys plugin (versions up to and including 1.2.1) where delete_passkey() and passkeys_list() lack proper authorization checks. This allows authenticated users with Subscriber+ privileges to view and delete passkeys. The issue has...