Apple App Store Connect 安全漏洞

Apple App Store Connect is an Apple platform for developers to manage and distribute applications. A security vulnerability exists in Apple App Store Connect version 3.0, which stems from an authentication issue that could lead to the disclosure of sensitive user information...

WordPress plugin Easy restaurant menu manager 跨站脚本漏洞

WordPress Easy restaurant menu manager is a WordPress plugin for managing restaurant menus , the main features include uploading and editing restaurant menus online and embedding them into the website through short codes or links. A cross-site scripting vulnerability exists in WordPress Easy...

CVE-2025-45784

D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVISUSERPASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools such as strings or xxd, potentially...

NCR Atleos Terminal Handler 安全漏洞

NCR Atleos Terminal Handler is an ATM enterprise software solution from NCR Atleos that reduces costs, improves business agility and increases your competitive advantage. A security vulnerability exists in NCR Atleos Terminal Handler version 1.5.1, which stems from improper authorization of SOAP...

CVE-2025-40675 Reflected Cross-Site Scripting (XSS) in Bagisto

A Reflected Cross-Site Scripting XSS vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. This vulnerability can be exploited to stea...

CVE-2025-31199

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.8.2, visionOS 2.4. An app may be able to access sensitive user data...

Tinxy WiFi Lock Controller 安全漏洞

Tinxy WiFi Lock Controller is a smart door lock from Tinxy. A security vulnerability exists in Tinxy WiFi Lock Controller v1. The vulnerability stems from storing sensitive user information in clear text, which may lead to information leakage...

CVE-2025-31199

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, visionOS 2.4, macOS Sequoia 15.4. An app may be able to access sensitive user data...

CVE-2025-31199

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.8.2, visionOS 2.4. An app may be able to access sensitive user data...

CVE-2025-31199

A logging issue in macOS, iOS, iPadOS, and visionOS allows an app to access sensitive user data due to insufficient data redaction. Specifically, known as Sploitlight , the vulnerability involves abusing Spotlight importers to bypass Transparency, Consent, and Control (TCC) protections. Attackers...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for the iPad tablet computer. A security vulnerability exists in Apple iOS and Apple iPadOS prior to version 18.4, which arises from...

CVE-2025-48926

The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers...

CVE-2025-40651

Reflected Cross-Site Scripting XSS vulnerability in Real Easy Store. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the keyword parameter in /index.php?a=search. This vulnerability can be exploited to steal...

CVE-2025-40651 Reflected Cross Site Scripting (XSS) in Real Easy Store

Reflected Cross-Site Scripting XSS vulnerability in Real Easy Store. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the keyword parameter in /index.php?a=search. This vulnerability can be exploited to steal...

CVE-2025-24109

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access sensitive user data...

CVE-2024-22721

Cross Site Request Forgery CSRF vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link...

CVE-2024-23205

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. An app may be able to access sensitive user data...

CVE-2024-40786

This issue was addressed through improved state management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Ventura 13.6.8. An attacker may be able to view sensitive user information...

CVE-2024-56962

An issue in Tencent Technology Shanghai Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link...

CVE-2024-49770

oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default oak does not allow transferring of hidden files with Context.send API. However, prior to version 17.1.3, this can be bypassed by encoding / as its URL encoded...