EUVD-2025-9316

Malicious code in bioql PyPI...

Denial of Service in CivetWeb

...

CVE-2025-59739

CVE-2025-59739 describes an OS command‑injection in AndSoft’s e‑TMS v25.03. The root cause is misuse of the m parameter in the request path /clt/LOGINFRM_original.ASP , exploitable via a POST to execute arbitrary commands on the server. Impact: potential full server compromise (as supported by CV...

PT-2025-40361

Name of the Vulnerable Software and Affected Versions AndSoft's e-TMS version 25.03 Description An operating system command injection issue exists that allows an attacker to execute operating system commands on the server. This is achieved by sending a POST request to the /CLT/LOGINERRORFRM.ASP...

CVE-2025-20362

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial...

CVE-2025-20362

CVE-2025-20362 affects Cisco Secure Firewall ASA/FTD VPN web server. Root cause: improper validation of user-supplied input in HTTP(S) requests, allowing an unauthenticated remote attacker to access restricted VPN-related URL endpoints. Impact: potential DoS via unexpected reloads (and in some re...

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

ADB MCP Server 安全漏洞

ADB MCP Server is a Model Context Protocol Server by Martin Arellano Personal Developer. A security vulnerability exists in ADB MCP Server version 0.1.0 and earlier, which stems from a command injection vulnerability in the MCP Server tool definition and implementation...

parse-server 安全漏洞

parse-server is a Node.js/Express parse server open-sourced by Parse Platform. A security vulnerability exists in parse-server version 5.3.0 and earlier, which stems from a prototype contamination in the SingleInstanceStateController.initializeState function, which allows an attacker to inject an...

WSO2 Identity Server 安全漏洞

WSO2 Identity Server IS is an identity server from the US-based WSO2 Inc. A security vulnerability exists in WSO2 Identity Server IS that stems from improper cryptographic design in adaptive authentication, which could lead to a cross-tenant authentication vulnerability...

PT-2025-39198

Name of the Vulnerable Software and Affected Versions Tenda AC9 version 1.0 Description A command injection issue exists in Tenda AC9 version 1.0. The issue is due to a flaw in the formSetSambaConf function within the httpd file, specifically through the usb.samba.guest.user parameter. This allow...

GO-2025-3953 Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling in go.temporal.io/server

Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling in go.temporal.io/server...

CVE-2025-34185

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a pre-authentication file disclosure vulnerability via the 'dblog' POST parameter. Remote attackers can retrieve arbitrary files from the server, exposing sensitive system information and credentials...

CVE-2025-34184

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or...

CVE-2025-34183

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential...

CVE-2025-34184

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or...

CVE-2025-34185

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a pre-authentication file disclosure vulnerability via the 'dblog' POST parameter. Remote attackers can retrieve arbitrary files from the server, exposing sensitive system information and credentials...

DEBIAN-CVE-2022-50345

In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv3 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This...

Ilevia EVE X1 Server 安全漏洞

Ilevia EVE X1 Server is a smart home and building automation from Ilevia, Italy. A security vulnerability exists in Ilevia EVE X1 Server 4.7.18.0.eden and prior versions, which originates from an unauthenticated OS command injection in the /ajax/php/login.php script, which could result in the...

CVE-2025-59154 Openfire allows potential identity spoofing via unsafe CN parsing

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...