OESA-2025-2089 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: NGINX Open Source and NGINX Plus have a vulnerability in the ngxmailsmtpmodule that might allow an unauthenticated attacker to over-read NGINX SMTP authentication...

CVE-2025-7812

The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.6. This is due to missing or incorrect nonce validation on the adminExport function. This makes it possible for unauthenticated...

DOS & CO SS1 安全漏洞

DOS & CO SS1 is an asset management tool from DOS & CO Japan. A security vulnerability exists in DOS & CO SS1 Ver.16.0.0.10 and earlier versions, which stems from the use of hard-coded passwords, and could allow a remote unauthenticated attacker to view arbitrary files with root privileges...

CVE-2025-9376: Incorrect Authorization

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check on the 'stopbadbotscheckwordpressloggedincookie' function in all versions up to, and including, 11.58. This...

CVE-2025-20317 Cisco UCS Virtual Keyboard Video Monitor (vKVM) Open Redirect Vulnerability

A vulnerability in the Virtual Keyboard Video Monitor vKVM connection handling of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to redirect a user to a malicious website. This vulnerability is due to insufficient verification of vKVM endpoints. An...

CVE-2025-20317 Cisco UCS Virtual Keyboard Video Monitor (vKVM) Open Redirect Vulnerability

A vulnerability in the Virtual Keyboard Video Monitor vKVM connection handling of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to redirect a user to a malicious website. This vulnerability is due to insufficient verification of vKVM endpoints. An...

CVE-2025-20317

Cisco CVE-2025-20317 affects the Integrated Management Controller (IMC) and the vKVM component (also in Cisco UCS Manager). The issue is an open redirect caused by insufficient verification of vKVM endpoints, allowing an unauthenticated, remote attacker to persuade a user to click a crafted link ...

CVE-2025-43728

Dell ThinOS 10, versions prior to 250810.0127, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass...

CVE-2025-4225: Allocation of Resources Without Limits or Throttling

An issue has been discovered in GitLab CE/EE affecting all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that that under certain conditions could have allowed an unauthenticated attacker to cause a denial-of-service condition affecting all users by sending specially...

Linux Distros Unpatched Vulnerability : CVE-2018-1089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer...

CVE-2025-41702

The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key...

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Network Address Translation DNS Inspection DoS (cisco-sa-asaftd-nat-dns-dos-bqhynHTM)

According to its self-reported version, Cisco Adaptive Security Appliance ASA Software is affected by a vulnerability. - A vulnerability in the function that performs IPv4 and IPv6 Network Address Translation NAT DNS inspection for Cisco Secure Firewall Adaptive Security Appliance ASA Software an...

CVE-2025-53118

An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM...

CVE-2025-53118 Securden Unified PAM Authentication Bypass

An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM...

EUVD-2025-25753

An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM...

CVE-2025-5514

The CVE-2025-5514 entry concerns Mitsubishi Electric MELSEC iQ-F Series CPU module, where the web server function is vulnerable to a DoS due to improper handling of a length parameter inconsistency. The issue allows a remote, unauthenticated attacker to delay or stall the web server by sending a ...

PT-2025-34675 · Unknown · Unified Pam

Name of the Vulnerable Software and Affected Versions: Unified PAM affected versions not specified Description: An authentication bypass allows unauthenticated attackers to control administrator backup functions. Successful exploitation can lead to the compromise of passwords, secrets, and...

CVE-2025-36157 IBM Jazz Foundation incorrect authorization

IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions...

CVE-2025-43765

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject...

CVE-2025-7839

CVE-2025-7839 affects the WordPress plugin “Restore Permanently delete Post or Page Data” (versions up to 1.0). The root cause is missing or incorrect nonce validation in the rp_dpo_dpa_ajax_dp_delete_data() function, enabling CSRF. This allows unauthenticated attackers to delete site data by tri...