CVE-2025-56161

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields bcrypt password hash, mobile...

PT-2025-40399

Name of the Vulnerable Software and Affected Versions YOSHOP 2.0 Description The software allows unauthorized disclosure of information through comment-list API endpoints within the Goods module. The Comment model loads the related User model without filtering specific fields. Due to the absence ...

CVE-2025-56161

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields bcrypt password hash, mobile...

ViDay 跨站脚本漏洞

ViDay is a business management platform from the Spanish company ViDay. ViDay suffers from a cross-site scripting vulnerability that originates from a JWT containing sensitive user information in an HTTP request, which could lead to information disclosure...

CVE-2025-59687

IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and notifications of an arbitrary organization...

LG Innotek LND7210和LG Innotek LNV7210R 安全漏洞

LG Innotek LND7210 and LG Innotek LNV7210R are both webcams from LG Innotek, a South Korean company. A security vulnerability exists in the LG Innotek LND7210 and LG Innotek LNV7210R, which stems from an authentication bypass that could lead to access to camera information and user account...

CVE-2025-59687

IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and notifications of an arbitrary organization...

Mattermost Server 10.10.x < 10.10.2 / 10.11.0 Missing Authorization (MMSA-2025-00513)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2025-00513 advisory. - Mattermost versions 10.10.x = 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or...

CVE-2025-58385

In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users there is hard-coded and predictable data...

CVE-2025-27262

Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges...

CVE-2025-27261

Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if exploited can result in unauthorized disclosure or modification of data...

PT-2025-39372

Name of the Vulnerable Software and Affected Versions Ericsson Indoor Connect 8855 affected versions not specified Description The software contains a SQL injection issue that could allow unauthorized disclosure and modification of user and configuration data. The issue involves a SQL injection...

Ericsson Indoor Connect 安全漏洞

Ericsson Indoor Connect is an indoor compact base station from Ericsson Sweden. A security vulnerability exists in Ericsson Indoor Connect version 8855, which stems from susceptibility to SQL injection attacks that could lead to unauthorized disclosure and modification of user and configuration...

Two Critical Flaws Uncovered in Wondershare RepairIt Exposing User Data and AI Models

Cybersecurity researchers have disclosed two security flaws in Wondershare RepairIt that exposed private user data and potentially exposed the system to artificial intelligence AI model tampering and supply chain risks. The critical-rated vulnerabilities in question, discovered by Trend Micro, ar...

CVE-2025-0672 Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association

An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may...

CVE-2025-0672

CVE-2025-0672 describes an authentication bypass affecting multiple WSO2 products when FIDO authentication is enabled. The root cause is that, after a user account is deleted, the system does not automatically purge associated FIDO registration data. If a new user account is created with the same...

AI-Powered App Exposes User Data, Creates Risk of Supply Chain Attacks

Trend™ Research’s analysis of Wondershare RepairIt reveals how the AI-driven app exposed sensitive user data due to unsecure cloud storage practices and hardcoded credentials, creating risks of model tampering and supply chain attacks...

PT-2025-39184

Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description An authentication bypass can occur in WSO2 products when FIDO authentication is enabled. Deletion of a user account does not automatically remove associated FIDO registration data. If a...

CVE-2022-50405

In the Linux kernel, the following vulnerability has been resolved: net/tunnel: wait until all skuserdata reader finish before releasing the sock There is a race condition in vxlan that when deleting a vxlan device during receiving packets, there is a possibility that the sock is released after...

DEBIAN-CVE-2022-50405

In the Linux kernel, the following vulnerability has been resolved: net/tunnel: wait until all skuserdata reader finish before releasing the sock There is a race condition in vxlan that when deleting a vxlan device during receiving packets, there is a possibility that the sock is released after...