CVE-2025-54799: Cleartext Transmission of Sensitive Information

Let's Encrypt client and ACME library written in Go Lego. In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package thus the lego library and the lego cli as well don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME...

CVE-2023-41530: Improper Neutralization of Special Elements used in an SQL Command

Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the appcontact parameter in appsearch.php...

Linux Distros Unpatched Vulnerability : CVE-2007-6762

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel before 2.6.20, there is an off-by-one bug in net/netlabel/netlabelcipsov4.c where it is possible to overflow the doidef-tags array...

Security update for kernel-livepatch-MICRO-6-0_Update_4

This update for kernel-livepatch-MICRO-6-0Update4 fixes the following issues: CVE-2024-53146: NFSD: prevent a potential integer overflow bsc1234854 CVE-2024-53166: block, bfq: fix bfqq uaf in bfqlimitdepth bsc1234885 CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: btrfs: don't drop extentmap for free space inode on write error CVE-2024-26726 In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats that have "%p.." CVE-2025-37938 In t...

Vaelsys V4 安全漏洞

Vaelsys V4 is an artificial intelligence video analytics platform from Vaelsys, Spain. A security vulnerability exists in Vaelsys V4 version .1.0, which stems from the manipulation of the parameter xajaxargs in the file /grid/vgridserver.php resulting in the use of a weak hash...

Vaelsys V4 安全漏洞

Vaelsys V4 is an artificial intelligence video analytics platform from Vaelsys, Spain. A security vulnerability exists in Vaelsys V4 version 4.1.0, which originates from improper authorization of the user creation handler in the file /grid/vgridserver.php...

CVE-2025-38430 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request

In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4spomustallow must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedure...

Malicious code in eth-multisig-v4 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0011f8c820d2bf5736f029e749e3b1eb172ec056d5d712b620b95ef9ba5aa4dd Any computer that has this package installed or running should be considered...

MAL-2025-5643 Malicious code in eth-multisig-v4 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0011f8c820d2bf5736f029e749e3b1eb172ec056d5d712b620b95ef9ba5aa4dd Any computer that has this package installed or running should be considered...

CVE-2025-34062: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directorytoken—which may be retrievable from host registry keys or improperly secured logs—can retrieve a plaintext respon...

CVE-2025-34063: Authentication Bypass by Spoofing

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary user...

CVE-2025-41647

A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions...

CVE-2025-41647

CVE-2025-41647 affects Lenze PLC Designer V4. A local, low-privilege attacker can learn the password of the connected controller because the software incorrectly displays the password in plaintext under special conditions. The vulnerability is documented across multiple sources (NVD/Red Hat/CVE r...

CVE-2025-41647: Cleartext Storage of Sensitive Information

A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions...

PT-2025-26820 · Unknown · Plc Designer V4

Name of the Vulnerable Software and Affected Versions: PLC Designer V4 Description: A local, low-privileged attacker can learn the password of the connected controller due to an incorrect implementation that results in the password being displayed in plain text under special conditions...

Lenze PLC Designer V4 安全漏洞

Lenze PLC Designer V4 is a programmable logic controller programming software from Lenze USA. A security vulnerability exists in Lenze PLC Designer V4 that stems from a password being displayed in clear text, which could lead to a low-privilege attacker gaining access to the password...

The vulnerability of the cipso_v4_doi_free() function in the net/ipv4/cipso_ipv4.c module of the Linux operating system’s IPv4 kernel implementation allows a attacker to compromise the confidentiality and accessibility of protected information.

The vulnerability of the cipsov4doifree function in the net/ipv4/cipsoipv4.c module of the Linux operating system’s IPv4 kernel implementation is related to improper memory release before deleting the last pointer memory leak. Exploiting this vulnerability could allow an attacker to compromise th...

CVE-2025-6151: Buffer Copy without Checking Size of Input

A vulnerability has been found in TP-Link TL-WR940N V4 and TL-WR841N V11. Affected by this issue is some unknown functionality of the file /userRpm/WanSlaacCfgRpm.htm, which may lead to buffer overflow. The attack may be launched remotely. This vulnerability only affects products that are no long...

CVE-2025-40674: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user...