DEBIAN-CVE-2025-10148

curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two...

AZL-67290 CVE-2025-10148 affecting package cmake for versions less than 3.30.3-10

curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two...

CVE-2025-58781

WTW-EAGLE App does not properly validate server certificates, which may allow a man-in-the-middle attacker to monitor encrypted traffic...

CVE-2025-58781

Vulnerability : CVE-2025-58781 affects the WTW-EAGLE App. The app does not properly validate server certificates, enabling a man-in-the-middle attacker to monitor encrypted traffic. Affected products/versions : WTW-EAGLE App for iOS prior to 4.4.1 and Android prior to 4.4.0.10. Other sources reit...

CVE-2025-10148

CVE-2025-10148 affects curl’s WebSocket implementation where the 32-bit mask pattern was not updated per outgoing frame as required by the spec. The fixed mask persisted for the entire connection, enabling a malicious server to induce traffic between the two communicating parties that an intermed...

CVE-2025-10148

curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two...

CVE-2025-10148 predictable WebSocket mask

curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two...

PT-2025-37350

Name of the Vulnerable Software and Affected Versions: Audi UTR 2.0 Universal Traffic Recorder 2.0 Description: An issue in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to arbitrarily overwrite files by submitting a crafted PUT request. Recommendations: At the moment, there is no...

WTW-EAGLE App 信任管理问题漏洞

WTW-EAGLE App is a mobile application from WTW that has the ability to provide risk management, insurance data access and analytics. A trust management issue vulnerability exists in the WTW-EAGLE App that stems from not properly validating server certificates, which could lead to a...

PT-2025-37348

Name of the Vulnerable Software and Affected Versions: Audi UTR 2.0 Universal Traffic Recorder 2.0 affected versions not specified Description: The web service contains an incorrect access control configuration, allowing attackers to download car information without authentication. Recommendation...

CVE-2025-45584

Incorrect access control in the web service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to download car information without authentication...

PT-2025-37347

Name of the Vulnerable Software and Affected Versions: Audi UTR 2.0 Universal Traffic Recorder 2.0 affected versions not specified Description: An incorrect access control issue exists in the FTP protocol. This allows attackers to authenticate to the service using any combination of username and...

CVE-2025-45586

CVE-2025-45586 affects Audi UTR 2.0 Universal Traffic Recorder 2.0. The issue allows an attacker to arbitrarily overwrite files by sending a crafted PUT request. The connected sources consistently describe a file overwrite condition via a crafted PUT to the affected application, but do not provid...

CVE-2025-45587

CVE-2025-45587 describes a stack overflow in the FTP service of Audi UTR 2.0 Universal Traffic Recorder 2.0 that allows attackers to cause a Denial of Service (DoS) via a crafted input. Affected component is the FTP service; root cause is a stack overflow. Documented impact: availability impact h...

CVE-2025-45584

The CVE-2025-45584 entry concerns Audi UTR 2.0 Universal Traffic Recorder 2.0. The vulnerability is described as an incorrect access control in the web service, enabling attackers to download car information without authentication. CVSS v3.1 base metrics indicate high impact on confidentiality (C...

CVE-2025-45586

An issue in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to arbitrarily overwrite files via supplying a crafted PUT request...

CVE-2025-45584

Incorrect access control in the web service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to download car information without authentication...

PT-2025-37351

Name of the Vulnerable Software and Affected Versions: Audi UTR 2.0 Universal Traffic Recorder 2.0 Description: A stack overflow in the FTP service allows attackers to cause a Denial of Service DoS via a crafted input. Recommendations: At the moment, there is no information about a newer version...

CVE-2025-45583

Incorrect access control in the FTP protocol of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to authenticate into the service using any combination of username and password...

CVE-2025-45583

CVE-2025-45583 affects Audi UTR 2.0 Universal Traffic Recorder 2.0. The vulnerability is an improper access control in the FTP protocol that allows an attacker to authenticate to the service using any username/password combination. CVSS metrics in the provided records indicate a CRITICAL base sco...