CVE-2025-55368

Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account...

jshERP 安全漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of Ji Sheng Hua in China. A security vulnerability exists in jshERP v3.5, which stems from improper access control in the UserController.java component and could lead to elevated levels of privilege...

Seagull FTP Client 安全漏洞

Seagull FTP Client is an FTP client software from Seagull USA. A security vulnerability exists in Seagull FTP Client v3.3 Build 409 and earlier versions, which stems from the FTP directory listing parser not validating the length of filenames, and could lead to a stack buffer overflow and executi...

PT-2025-34311 · Sftpclient · Xftp Client

Name of the Vulnerable Software and Affected Versions: Xftp FTP Client versions through 3.0 build 0238 Description: Xftp FTP Client versions up to and including 3.0 build 0238 contain a stack-based buffer overflow vulnerability. This issue is triggered by a maliciously crafted PWD response from a...

MIT krb5 security vulnerability

MIT krb5 MIT Kerberos 5 is the United States of America Massachusetts Institute of Technology Massachusetts Institute Of Technology University of a set of network authentication protocols, which uses a client/server structure, and both the client and server side of the identity of the other party...

CVE-2025-55522

Cross-site scripting XSS vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter...

CVE-2011-10022

SPlayer version 3.7 and earlier is vulnerable to a stack-based buffer overflow when processing HTTP responses containing an overly long Content-Type header. The vulnerability occurs due to improper bounds checking on the header value, allowing an attacker to overwrite the Structured Exception...

CVE-2025-9229 Information Disclosure in MiR robots and MiR fleet through verbose error pages

Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error information, such as file paths and other data, via access to verbose error pages...

PT-2025-33943 · WordPress · Templately

Name of the Vulnerable Software and Affected Versions: Templately versions through 3.2.7 Description: An information insertion issue in WPDeveloper Templately allows retrieval of embedded sensitive data. Recommendations: At the moment, there is no information about a newer version that contains a...

Mobile Industrial Robots MiR Robots 安全漏洞

Mobile Industrial Robots MiR Robots is an autonomous mobile robot from Mobile Industrial Robots, Denmark. A security vulnerability exists in Mobile Industrial Robots MiR Robots versions prior to 3.0.0, which originates from stored cross-site scripting and could lead to the execution of arbitrary...

PT-2025-33924 · Lambertgroup · Lambertgroup Apollo

Name of the Vulnerable Software and Affected Versions: LambertGroup Apollo - Sticky Full Width HTML5 Audio Player versions through 3.4 Description: This issue involves improper neutralization of input during web page generation, leading to a reflected cross-site scripting XSS condition...

Linux Distros Unpatched Vulnerability : CVE-2022-1434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacke...

CVE-2025-6758

The CVE covers the Real Spaces – WordPress Properties Directory Theme for WordPress, vulnerable to unauthenticated privilege escalation via the imic_agent_register function in all versions up to 3.6. The flaw stems from insufficient restrictions on the registration role, allowing an attacker to s...

Linux Distros Unpatched Vulnerability : CVE-2024-46292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service DoS via a crafted input inserted into the name parameter. NOTE: this is...

Linux Distros Unpatched Vulnerability : CVE-2017-9465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The yrarenawritedata function in YARA 3.6.1 allows remote attackers to cause a denial of service buffer over-read and application crash or obtain sensitive...

WordPress Real Spaces Theme <= 3.6 is vulnerable to Privilege Escalation

Software Real Spaces Type Theme Vulnerable versions = 3.6 Fixed in 3.6.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-6758 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 53452ea06b41 Credits Alyudin Nafiie...

Security update for apache-commons-lang3

This update for apache-commons-lang3 fixes the following issues: Update to version 3.18.0 CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. bsc1246397 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2025:02818-1 Security update for apache-commons-lang3

This update for apache-commons-lang3 fixes the following issues: - Update to version 3.18.0 - CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. bsc1246397...

Malicious code in @zalastax/nolb-_v3 (npm)

The package @zalastax/nolb-v3 was found to contain malicious code...

CVE-2025-55198

A flaw was found in helm.sh/helm/v3. Improper validation of type errors during parsing of Chart.yaml and index.yaml files can trigger a panic. A remote attacker, requiring user interaction, can trigger this panic via a malformed chart file. This can lead to an application level denial of service...