CLSA-2025-1748638011 Update of httpd

ELS-1267: merge spec for centos7, rhel7 and oracle7...

WordPress Real Time Validation for Gravity Forms plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross Site Request Forgery CSRF to Settings Change vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Real Time Validation for Gravity Forms versions = 1.7.0...

CVE-2025-5328

A vulnerability was found in chshcms mccms 2.7. It has been declared as critical. This vulnerability affects the function restoredel of the file /sys/apps/controllers/admin/Backups.php. The manipulation of the argument dirs leads to path traversal. The attack can be initiated remotely. The exploi...

DEBIAN-CVE-2025-27151

Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlenfilepath when copying a user-supplied file path into a fixed-size stack buffer. This allo...

CVE-2025-4687 Account pre-hijacking through invite misuse

In Teltonika Networks Remote Management System RMS, it is possible to perform account pre-hijacking by misusing the invite functionality. If a victim has a pending invite and registers to the platform directly, they are added to the attackers company without their knowledge. The victims account a...

CVE-2025-45529

An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET request to /cms/templates/templatesAssetsEditor...

mccms 路径遍历漏洞

mccms diffuse city CMS is a rapid website building system for individual developers of China Smokey River South chshcms. A path traversal vulnerability exists in version 2.7 of mccms, which stems from a path traversal caused by incorrect operation of the parameter dirs in the file...

mccms 代码问题漏洞

mccms Man City CMS is a rapid website building system for individual developers of China Smokey River South chshcms. A code issue vulnerability exists in version 2.7 of mccms, which stems from improper handling of the pic parameter in the file sys/apps/controllers/api/Gf.php, which may lead to...

Redis 安全漏洞

Redis is an open source, ANSI C, network-enabled, memory-based, persistent logging, key-value Key-Value storage database from Redis, Inc. that provides APIs in multiple languages. A security vulnerability exists in Redis versions prior to 7.0.0 through 8.0.2, which stems from a stack-based buffer...

Teltonika Remote Management System 安全漏洞

Teltonika Remote Management System is a remote management system used by Teltonika to manage Teltonika products. A security vulnerability exists in Teltonika Remote Management System versions prior to 5.7, which stems from misuse of the invite feature and could lead to account pre-hijacking...

Best Practical RT 跨站脚本漏洞

Best Practical RT is a request tracker from Best Practical, Inc. A cross-site scripting vulnerability exists in Best Practical RT versions 5.0 through 5.0.7, which stems from the injection of JavaScript into an asset name and could lead to cross-site scripting...

CADRE: Customizable Assurance of Data Readiness in Privacy-Preserving Federated Learning

Privacy-Preserving Federated Learning PPFL is a decentralized machine learning approach where multiple clients train a model collaboratively. PPFL preserves privacy and security of the client's data by not exchanging it. However, ensuring that data at each client is of high quality and ready for...

Fortinet FortiOS 输入验证错误漏洞

Fortinet FortiOS is a set of security operating systems dedicated to the FortiGate network security platform from the U.S. company Fiat Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An input validation...

CVE-2024-47090

CVE-2024-47090 affects Nagvis prior to version 1.9.47 and allows an XSS via the WYSIWYG editor (improper input neutralization). Connected sources confirm Debian/Debian LTS advisory DLA-4233-1 fixes this issue in Debian 11 with Nagvis package 1:1.9.25-2+deb11u2. The Nessus entry also references an...

CVE-2025-48827

creationtimestamp| type| source ---|---|--- 2025-05-27 04:47:54+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17606 2025-05-27 05:35:48+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lq4xrqhgwpy2 2025-05-27...

CVE-2025-5217

creationtimestamp| type| source ---|---|--- 2025-05-27 00:47:48+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17588 2025-05-27 03:36:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lq4r45qmbw27 2025-05-27 03:36:32+00:00| seen|...

Wing FTP Server 安全漏洞

Wing FTP Server is the Wing FTP Server open source suite of cross-platform FTP server software. A security vulnerability exists in Wing FTP Server 7.4.3 and earlier versions, which originates from the execution of unnecessary privileges...

Vulnerability of the VS6EditData!CDataRomErrorCheck::MacroCommandCheck() function in the HMI configuration software for Monitouch V-SFT: This vulnerability allows an attacker to gain unauthorized access to protected information, execute arbitrary code, or cause a service failure.

The vulnerability of the VS6EditData!CDataRomErrorCheck::MacroCommandCheck function in the HMI configuration software for Monitouch V-SFT lies in the possibility of the operation exceeding the buffer limits in memory. Exploiting this vulnerability could allow an attacker to gain unauthorized acce...

Vulnerability of the VS6EditData!CGamenDataRom::set_mr400_strc() function in the programming tool for configuring HMI interfaces of Monitouch V-SFT: This allows an attacker to gain unauthorized access to protected information, execute arbitrary code, or cause a service failure.

The vulnerability of the VS6EditData!CGamenDataRom::setmr400strc function in the HMI configuration software for Monitouch V-SFT is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected...

The vulnerability of the VS6MemInIF!set_temp_typedefault() function in the HMI configuration software for Monitouch V-SFT allows a malicious individual to gain unauthorized access to protected information, execute arbitrary code, or cause service failure.

The vulnerability of the VS6MemInIF!settemptypedefault function in the HMI configuration software for Monitouch V-SFT is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information,...