CVE-2025-55229

Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network...

Mattermost Fails to Validate File Paths

Mattermost versions 10.9.x = 10.9.1, 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal during plugin import operations. An attacker can access unauthorized files and bypass plugin signature enforcement and marketplace restrictions by submitting specially crafted file paths during plugin import...

CVE-2025-36530

Mattermost versions 10.9.x = 10.9.1, 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin...

CVE-2025-36530 Import Path Traversal Enables Unauthorized Unsigned Plugin Installation

Mattermost versions 10.9.x = 10.9.1, 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin...

CVE-2025-36530

Mattermost contains a path traversal vulnerability in the plugin import flow (affecting 9.11.x up to 9.11.17, 10.5.x up to 10.5.8, 10.8.x up to 10.8.3, 10.9.x up to 10.9.1). The root cause is improper validation of file paths during plugin import, which allows restricted admin users to install un...

Windows Certificate Spoofing Vulnerability

Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network...

Microsoft Windows Certificates 数据伪造问题漏洞

Microsoft Windows Certificates is a digital certificate software from Microsoft Corporation USA. A data forgery vulnerability exists in Microsoft Windows Certificates that stems from improper cryptographic signature verification and could lead to spoofing attacks...

PT-2025-34295

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network. Recommendations: At the moment, there is no...

Linux Distros Unpatched Vulnerability : CVE-2023-44483

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a privat...

CVE-2025-31355

A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted malicious file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2025-31355

A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted malicious file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2025-31355

A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted malicious file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2025-31355

CVE-2025-31355 affects the Tenda AC6 V5.0 (V02.03.01.110) firmware. Talos reports a firmware update vulnerability in the Firmware Signature Validation function that allows an attacker to flash a malicious upgrade file, potentially executing arbitrary code. The analysis shows the device validates ...

Tenda AC6 安全漏洞

Tenda AC6 is a dual-band wireless router from Tenda that supports IPv4 and IPv6 protocols and utilizes the 802.11ac/n wireless standard to provide a wireless transmission rate of 1167Mbps. A code execution vulnerability exists in the Tenda AC6, which stems from a problem with the firmware signatu...

PT-2025-34048 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version V02.03.01.110 Description: A firmware update vulnerability exists in the Firmware Signature Validation functionality. A specially crafted malicious file can lead to arbitrary code execution. An attacker can provide a malicio...

Linux Distros Unpatched Vulnerability : CVE-2016-1000342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject...

Tenda AC6 V5.0 Firmware Signature Validation firmware update vulnerability

Talos Vulnerability Report TALOS-2025-2161 Tenda AC6 V5.0 Firmware Signature Validation firmware update vulnerability August 20, 2025 CVE Number CVE-2025-31355 SUMMARY A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. A...

Linux Distros Unpatched Vulnerability : CVE-2025-30258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags,...

The vulnerability relates to the implementation of OAuth request signature logic in Python’s OAuthLib. It stems from insufficient validation of input data, allowing attackers to trigger a service denial.

The vulnerability relates to the implementation of OAuth request signature logic in Python’s OAuthLib. It stems from insufficient validation of input data in the urivalidate functions. Exploiting this vulnerability could allow an attacker to trigger a service denial...