TencentOS Server 4: bcc (TSSA-2024:1074)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1074 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2024-7457

The ws.stash.app.mac.daemon.helper tool contains a vulnerability caused by an incorrect use of macOS’s authorization model. Instead of validating the client's authorization reference, the helper invokes AuthorizationCopyRights using its own privileged context root, effectively authorizing itself...

CVE-2025-40669

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&Page=-1...

CVE-2025-40670

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser...

CVE-2024-7457

The ws.stash.app.mac.daemon.helper tool contains a vulnerability caused by an incorrect use of macOS’s authorization model. Instead of validating the client's authorization reference, the helper invokes AuthorizationCopyRights using its own privileged context root, effectively authorizing itself...

BIT-MARIADB-MIN-2020-28912

With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between...

PT-2025-25165 · Unknown · Ws.Stash.App.Mac.Daemon.Helper

Name of the Vulnerable Software and Affected Versions: ws.stash.app.mac.daemon.helper affected versions not specified Description: The issue is caused by an incorrect use of macOS’s authorization model in the ws.stash.app.mac.daemon.helper tool. Instead of validating the client's authorization...

CVE-2025-40670

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser...

CVE-2025-40669

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&Page=-1...

CVE-2025-40670 Incorrect Authorization vulnerability in TCMAN GIM

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser...

CVE-2025-40670 Incorrect Authorization vulnerability in TCMAN GIM

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser...

CVE-2025-40670

CVE-2025-40670 affects TCMAN GIM v11. The vulnerability is an incorrect authorization flaw that allows an unprivileged attacker to create a user and assign it many privileges by sending a POST to /PC/frmGestionUser.aspx/updateUser. Affected software and component: TCMAN GIM v11, web-based user-ma...

CVE-2025-40669 Incorrect Authorization vulnerability in TCMAN GIM

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&Page=-1...

CVE-2025-40669

CVE-2025-40669 affects TCMAN’s GIM v11. The root cause is incorrect authorization, enabling an unprivileged attacker to modify the permissions of all application users, including themselves, by sending a POST to /PC/Options.aspx?Command=2&Page=-1. Reported across multiple sources (NVD, RH, CVE ca...

CVE-2025-40669 Incorrect Authorization vulnerability in TCMAN GIM

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&Page=-1...

WordPress MediClinic Theme <= 2.1 is vulnerable to Local File Inclusion

Software MediClinic Type Theme Vulnerable versions = 2.1 Fixed in 2.2 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-49295 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 856af99d1029 Credits Bonds Required privilege Unauthenticated Published...

NewStart CGSL MAIN 7.02 : libvirt Multiple Vulnerabilities (NS-SA-2025-0071)

The remote NewStart CGSL host, running version MAIN 7.02, has libvirt packages installed that are affected by multiple vulnerabilities: - A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is...

TCMAN GIM 安全漏洞

TCMAN GIM is a management system from the Spanish company TCMAN. A security vulnerability exists in TCMAN GIM version v11, which stems from improper authorization and could allow an unprivileged attacker to modify user privileges...

TCMAN GIM 安全漏洞

TCMAN GIM is a management system from the Spanish company TCMAN. A security vulnerability exists in TCMAN GIM version v11, which stems from improper authorization and could allow an unprivileged attacker to create users and assign privileges...

WordPress Epicwin Plugin plugin <= 1.5 - CSRF to SQL Injection vulnerability

CSRF to SQL Injection vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Epicwin Plugin versions = 1.5...