CVE-2025-2264

A Path Traversal Information Disclosure vulnerability exists in "Sante PACS Server.exe". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed...

CVE-2025-2263

Sante PACS Server CVE-2025-2263 is a stack-based buffer overflow in the EVP_DecryptUpdate call during login in Sante PACS Server.exe. It passes a fixed 0x80-byte buffer as the output, allowing an unauthenticated remote attacker to send a long encrypted username/password to overflow the stack, wit...

CVE-2024-28803

Cross-site scripting XSS vulnerability in Italtel S.p.A. i-MCS NFV v.12.1.0-20211215 allows unauthenticated remote attackers to inject arbitrary web script or HTML into HTTP/POST parameter...

CVE-2025-2263: Stack-based Buffer Overflow

During login to the web server in "Sante PACS Server.exe", OpenSSL function EVPDecryptUpdate is called to decrypt the username and password. A fixed 0x80-byte stack-based buffer is passed to the function as the output buffer. A stack-based buffer overflow exists if a long encrypted username or...

CVE-2025-2264: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal Information Disclosure vulnerability exists in "Sante PACS Server.exe". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed...

CVE-2025-20145

Cisco IOS XR Software contains an ACL processing issue in the egress direction that can allow an unauthenticated, remote attacker to bypass a configured egress ACL. The root cause involves certain packets being mishandled when received on an ingress interface on one line card and destined to an e...

CVE-2025-20144 Cisco IOS XR Software Access Control List Bypass Vulnerability

A vulnerability in the hybrid access control list ACL processing of IPv4 packets in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incorrect handling of packets when a specific configuration of the hybrid ACL exists. ...

Cisco IOS XR Software Access Control List Bypass Vulnerability

A vulnerability in the access control list ACL processing in the egress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability exists because certain packets are handled incorrectly when they are received on an ingress...

CVE-2025-1393 Weidmueller: Authentication Vulnerability due to Hard-coded Credentials

An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product...

CVE-2025-1393

CVE-2025-1393: An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product. Multiple connected sources confirm unauthenticated access with full admin rights; one listing ties the issue to Weidmueller PROCON-WIN versions prior to...

CVE-2025-1393: Use of Hard-coded Credentials

An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product...

Linux Distros Unpatched Vulnerability : CVE-2023-26035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33...

CVE-2020-3122 Cisco Content Security Management Appliance Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to obtain sensitive network information...

CVE-2024-50704: Improper Control of Generation of Code

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially crafted HTTP POST request...

PT-2025-9793

Name of the Vulnerable Software and Affected Versions Weidmueller PROCON-WIN versions prior to 5.7.14.1 Description The issue is related to the use of hard-coded credentials in the PROCON-WIN SCADA system, allowing an unauthenticated remote attacker to gain full administration privileges on the...

Metasploit Weekly Wrap-Up: 02/28/2025

New module content 5 mySCADA myPRO Manager Credential Harvester CVE-2025-24865 and CVE-2025-22896 Author: Michael Heinzl Type: Auxiliary Pull request: 19878 contributed by h4x-x0r Path: admin/scada/mypromgrcreds AttackerKB reference: CVE-2025-22896 Description: This module adds credential...

CVE-2025-0731

An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user...

VulnCheck KEV: CVE-2024-20439

Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials...

CVE-2025-0731

An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user...

Siemens SCALANCE W700 Uncontrolled Resource Consumption (CVE-2024-23814)

The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving specially crafted messages targeting IP fragment re- assembly. This could allow an unauthenticated remote attacker to cause a temporary denial of service...