gnome-remote-desktop: Uncontrolled Resource Consumption due to Malformed RDP PDUs

A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result in gnome-remote-desktop no longer bei...

LuxSoft Luxcal 安全漏洞

LuxSoft Luxcal is a web calendar system organized by LuxSoft Belgium. A security vulnerability exists in LuxSoft Luxcal version 4.5.2, which stems from the presence of reflective cross-site scripting in index.php, which could allow an unauthenticated attacker to steal user data...

PT-2025-30255 · Conftool · Conftool

Name of the Vulnerable Software and Affected Versions: Conftool affected versions not specified Description: An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device, causing a denial of service. This issue specifically affects the network initializing wizard...

CVE-2020-26799

LuxSoft Luxcal 4.5.2 is affected by a reflected XSS in index.php that could allow an unauthenticated attacker to steal other users’ data. Reported as CVE-2020-26799, the issue is confirmed across multiple sources (NVD/Red Hat/CVElist entries) and linked advisories indicate the affected version is...

OpenJDK 8 <= 8u452 / 11.0.0 <= 11.0.27 / 17.0.0 <= 17.0.15 / 21.0.0 <= 21.0.7 / 24.0.0 <= 24.0.1 Multiple Vulnerabilities (2025-07-15)

The version of OpenJDK installed on the remote host is 8 prior to 8u452 / 11.0.0 prior to 11.0.27 / 17.0.0 prior to 17.0.15 / 21.0.0 prior to 21.0.7 / 24.0.0 prior to 24.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 2025-07-15 advisory. Please Note: Java CVEs do...

CVE-2020-26799

A reflected cross-site scripting XSS vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users' data...

PT-2025-30282 · Commscope · Ruckus Zonedirector +1

Name of the Vulnerable Software and Affected Versions: CommScope Ruckus Unleashed versions prior to 200.14.6.1.203 CommScope Ruckus ZoneDirector affected versions not specified Description: A path-traversal flaw exists in the web interface. This flaw allows the server to execute attacker-supplied...

CVE-2025-34300

A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands...

Oracle Java SE Multiple Vulnerabilities (July 2025 CPU)

The versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory. - Vulnerability in Oracle Java SE component: JavaFX libxml2. Supported versions that are affected are Oracle Java SE: 8u451-b50. Difficult to exploit vulnerabili...

CVE-2025-30746

Vulnerability in the Oracle iStore product of Oracle E-Business Suite component: Shopping Cart. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks...

CVE-2025-50072

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebLogic...

CVE-2025-54068 Livewire vulnerable to remote command execution during property update hydration

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is...

CVE-2025-25257

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execu...

CVE-2025-20288

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-side request forgery SSRF attack through an affected device. This vulnerability is due to improper input validation for specific HTTP...

EUVD-2025-21694

A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands...

CVE-2025-7673

CVE-2025-7673 affects Zyxel VMG8825-T50K with firmware versions prior to V5.50(ABOM.5)C0. A buffer overflow in the URL parser of the zhttpd web server could be triggered by a specially crafted HTTP request, allowing an unauthenticated attacker to cause a denial-of-service condition and potentiall...

CVE-2025-52689

CVE-2025-52689 affects Alcatel-Lucent OmniAccess Stellar Wi‑Fi APs (e.g., Stellar series) via a weak session ID check in the web management interface. The root cause allows an unauthenticated attacker to spoof a login and obtain a valid administrator session ID, potentially letting the attacker m...

CVE-2025-6977

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘pmgetmessengernotification’ function in all versions up to, and including, 5.9.5.4 due to insufficient input sanitization and output escaping. This makes it possib...

Amazon Corretto Java 8.x < 8.462.08.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is 8 prior to 8.462.08.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2025-Jul-15 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produ...

Oracle OpenJDK 8.x - 11.x Vulnerability (Jul 2025)

Oracle OpenJDK is prone to a vulnerability in the core-libs/javax.script component. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...