CVE-2025-8070 Windows service registered with an unquoted ImagePath vulnerability in the system registry

The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary code by placing a malicious executable in a predictable location such as C:\Program.exe. If the service runs with elevated privileges,...

CVE-2025-43881

Improper validation of specified quantity in input issue exists in Real-time Bus Tracking System versions prior to 1.1. If exploited, a denial of service DoS condition may be caused by an attacker who can log in to the administrative page of the affected product...

Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service

Summary A Denial of Service DoS vulnerability exists in Kyverno due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft expressions using the @ variable combined with a pipe and an invalid JMESPath function e.g., @ |...

CVE-2025-51865

CVE-2025-51865 concerns the Ai2 Playground web service (playground.allenai.org). The vulnerability is an Insecure Direct Object Reference (IDOR) that lets an attacker enumerate thread keys in the URL to gain sensitive information. The CVE is tracked with CVSS 3.1: Network attack, Low attack compl...

PT-2025-30315

Name of the Vulnerable Software and Affected Versions Netgear RAX30 version 1.0.10.94 3 Description The USERLIMIT GLOBAL option is set to 0 in multiple bftpd-related configuration files, potentially leading to denial-of-service DoS attacks when an unlimited number of users connect. Recommendation...

CVE-2025-7912

A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748B20211015. This issue affects the function recvSlaveUpgstatus of the component MQTT Service. The manipulation of the argument s leads to buffer overflow. The attack may be initiated remotely. The exploit h...

CVE-2025-36097

IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stack-based overflow. An attacker can send a specially crafted request that cause the server to consume excessive memory resources...

Hewlett Packard Enterprise AutoPass License Server Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Hewlett Packard Enterprise AutoPass License Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 5814 by...

PT-2025-30147 · Totolink · Totolink T6

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.5cu.748 B20211015 Description: A critical vulnerability exists in the MQTT Service component of the affected software. The recvSlaveStaInfo function is susceptible to a buffer overflow due to manipulation of the dest...

GHSA-7XQM-7738-642X File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing

Summary A Denial of Service DoS vulnerability exists in the file processing logic when reading a file on endpoint Filebrowser-Server-IP:PORT/files/file-name . While the server correctly handles and stores uploaded files, it attempts to load the entire content into memory during read operations...

The vulnerability of the Universal Plug and Play (UPnP) Device Host Service in Microsoft Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the Universal Plug and Play UPnP Device Host Service in Microsoft Windows operating systems is related to the ability to utilize freed memory. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

Oracle MySQL Server 8.0.0 - 8.0.42 Security Update (cpujul2025) - Linux

Oracle MySQL Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2025-30744

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Multiplatform Sync Errors. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobi...

CVE-2025-53893 File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File Processing

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.38.0, a Denial of Service DoS vulnerability exists in the file processing logic when reading a file on endpoint...

CVE-2024-42650

CVE-2024-42650 affects NanoMQ 0.17.5, with a segmentation fault in the /nanomq/pub_handler.c component. The vulnerability can be triggered by a crafted PUBLISH message, allowing a Denial of Service. Exploitation details are not elaborated in the provided documents beyond this description. No reme...

CVE-2025-29606

py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...

CVE-2025-53636 Open OnDemand Shell App closed websocket DoS

Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service DoS to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6...

CVE-2025-52952 Junos OS: MX Series with MPC-BUILTIN, MPC 1 through MPC 9: Receipt and processing of a malformed packet causes one or more FPCs to crash

An Out-of-bounds Write vulnerability in the connectivity fault management CFM daemon of Juniper Networks Junos OS on MX Series with MPC-BUILTIN, MPC1 through MPC9 line cards allows an unauthenticated adjacent attacker to send a malformed packet to the device, leading to an FPC crash and restart,...

CVE-2025-5241

CVE-2025-5241 affects Mitsubishi Electric MELSEC iQ-F Series. A remote, unauthenticated attacker can trigger a denial-of-service by exploiting an overly restrictive account lockout mechanism, causing legitimate users to be blocked for a period after repeated incorrect login attempts. The impact i...

Huawei EulerOS: Security Advisory for libarchive (EulerOS-SA-2025-1801)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...