29183 matches found
CVE-2019-25249 devolo dLAN 500 AV Wireless+ 3.1.0-1 Remote Code Execution via htmlmgr
devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI script. Attackers can enable telnet and remote shell services, reboot the device, and gain root access without a password by manipulating...
CVE-2025-2155 Arbitrary File Upload in EchoCCS's Specto CM
Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion. This issue affects Specto CM: before 17032025...
Server-Side Request Forgery (SSRF)
@lobehub/chat is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation and restriction of user-supplied URLs in the tools.search.crawlPages tRPC endpoint, which allows an attacker with a valid token to supply arbitrary URLs and force the server to mak...
CVE-2025-67743
Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow...
curl: Protocol Smuggling / CRLF Injection via Gopher Protocol allows Arbitrary Command Injection
Summary: I have discovered that the Gopher protocol implementation in curl fails to properly sanitize newline characters %0d%0 in the selector path. This allows an attacker to inject arbitrary TCP commands when curl connects to a target server via gopher://. This vulnerability enables Protocol...
PT-2025-53335
Name of the Vulnerable Software and Affected Versions devolo dLAN 500 AV Wireless+ version 3.1.0-1 Description The device contains a flaw that allows attackers to bypass authentication and enable hidden services through the htmlmgr CGI script. Attackers can enable services like telnet and remote...
PT-2025-53366
Name of the Vulnerable Software and Affected Versions Microhard Systems IPn4G version 1.1.0 Description An issue exists in Microhard Systems IPn4G that allows authenticated attackers to list and manipulate running system processes. Attackers can send arbitrary signals to kill background processes...
Devolo dLAN 500 AV Wireless+ 安全漏洞
The Devolo dLAN 500 AV Wireless+ is a powerline communication adapter from Devolo, Germany. A security vulnerability exists in the Devolo dLAN 500 AV Wireless+ version 3.1.0-1, which stems from an authentication bypass that could result in enabling hidden services and gaining root privileges...
EUVD-2025-204778
Local Deep Research is Vulnerable to Server-Side Request Forgery SSRF in Download Service...
CVE-2025-8305
An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in plaintext in Identity Agent for Terminal Services debug files...
CVE-2025-67743
CVE-2025-67743 affects Local Deep Research. The vulnerability lies in the download service (download_service.py) where HTTP requests are made with raw requests.get() without SSRF protection, bypassing safeguards in safe_requests.py/ssrf_validator.py. This can allow an attacker to access internal ...
CVE-2025-67743 Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow...
The vulnerability of the administration portal of Cisco Identity Services Engine (ISE) allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Cisco Identity Services Engine ISE administration portal is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
PT-2025-52729
Name of the Vulnerable Software and Affected Versions Local Deep Research versions 1.3.0 through 1.3.8 Description The software is an AI-powered research assistant. A flaw exists in the download service download service.py where HTTP requests are made using raw requests.get calls, bypassing the...
CVE-2025-8305
An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in plaintext in Identity Agent for Terminal Services debug files...
CVE-2025-8305 Information Disclosure in Identity Agent Debug Files
An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in plaintext in Identity Agent for Terminal Services debug files...
CVE-2025-8305 Information Disclosure in Identity Agent Debug Files
An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in plaintext in Identity Agent for Terminal Services debug files...
CVE-2025-8305
CVE-2025-8305 concerns Check Point Identity Agent for Terminal Services. An authenticated local user can access plaintext debug files that expose sensitive information, enabling the user to claim security policy rules of another user. The root cause is sensitive data printed in plaintext in Ident...
NetBT Consulting Services E-Fatura 代码问题漏洞
NetBT Consulting Services E-Fatura is an enterprise financial software from NetBT Consulting Services, Turkey. A code issue vulnerability exists in NetBT Consulting Services E-Fatura versions prior to 1.2.15, which stems from an un-referenced search path or element that could lead to the...
