8486 matches found
CVE-2025-52632
A Missing Secure Attribute in Encrypted Session SSL Cookie vulnerability in HCL AION.This issue affects AION: 2.0...
CVE-2025-11380
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everestprocessstatus' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for...
PT-2025-41630
Name of the Vulnerable Software and Affected Versions Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin versions prior to 2.3.6 Description The Everest Backup plugin for WordPress allows unauthorized access to data due to a missing capability check on the everest proces...
PT-2025-43399
Name of the Vulnerable Software and Affected Versions Tenda AC6 V2.0 version 15.03.06.50 Description The Tenda AC6 V2.0 router contains a stack overflow in the addressNat function due to a flaw in the handling of the page parameter. A crafted input can trigger this issue, leading to a Denial of...
WordPress plugin Web Accessibility By accessiBe 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host a personal blog site on a PHP and MySQL based...
EulerOS 2.0 SP11 : python-urllib3 (EulerOS-SA-2025-2245)
According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by...
CVE-2025-35058
Newforma Info Exchange NIX '/UserWeb/Common/MarkupServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the customer-configured NIX service account...
CVE-2025-62158
Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the fil...
EUVD-2025-33711
rardecode: DoS risk due to unrestricted RAR dictionary sizes...
EUVD-2025-33704
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0...
CVE-2025-52625
A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue affects AION: 2.0...
CVE-2025-11579 DoS via Out Of Memory Crash
github.com/nwaples/rardecode versions =2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash...
EUVD-2025-33699
A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other injection-based attacks.This issue affects AION: 2.0...
CVE-2025-52635
HCL AION (AI lifecycle platform) is affected in version 2.0 by a vulnerability where trusted types in scripts are not enforced by the Content Security Policy (CSP). This Trusted Types CSP bypass leads to information disclosure risk. Reports from multiple sources (NVD, CNVD, RH, CVE records, EUVD,...
CVE-2025-52650
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0...
CVE-2025-52650
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0...
CVE-2025-52630
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0...
EUVD-2025-33702
A Missing Secure Attribute in Encrypted Session SSL Cookie vulnerability in HCL AION.This issue affects AION: 2.0...
CVE-2025-52630
CVE-2025-52630 affects HCL AION (AION: 2.0). The connected sources describe an information disclosure vulnerability caused by a missing or insecure X-Content-Type-Options header, enabling an unauthorized actor to obtain credentials or system information. Public documents attribute this to HCL AIO...