CVE-2025-32329

In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2025-32328

In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2025-13472

CVE-2025-13472 concerns the BlazeMeter Jenkins Plugin. The Red Hat and NVD entries, plus multiple security advisories, confirm that versions prior to 4.27 expose a list of sensitive resources (credential IDs, BlazeMeter workspaces, and project IDs) to users who should not have access. The underly...

PT-2025-49000

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A flaw exists in the Framework component of Android operating systems due to insufficient protection of service data. Exploitation may allow a remote attacker to elevate privileges...

CVE-2025-10039 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the 'ehcrmticketsingleviewclient' due to missing validation on a user controlled key. This makes it possible for...

CVE-2025-41436

Mattermost versions 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost versions prior to 11.0, which stems from a failure to properly implement a setting that allows users to view archived channels, which could result in a...

CVE-2025-12636

The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The attacker would then be able to gain unauthorized access to available cameras, enabling the viewing of live feeds or modification of settings...

EUVD-2025-37930

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. An attacker with physical access to a locked device may be able to view sensitive user information...

PT-2025-44810

A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen...

GHSA-XF7M-V66Q-76W8 Liferay Portal and DXP do not check permissions of images in a blog entry

Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers ...

CVE-2025-10921

A heap-based buffer-overflow in GIMP’s HDR RGBE file parsing CVE-2025-10921 / ZDI-25-910 allows an attacker to execute arbitrary code when a user opens or is tricked into previewing a malicious HDR file. The flaw is caused by missing length validation before copying user-supplied HDR data into a...

CVE-2025-63608

A SQL injection vulnerability exists in CSZ-CMS versions

CVE-2025-43024

A GUI dialog of an application allows to view what files are in the file system without proper authorization...

HP ThinPro 安全漏洞

HP ThinPro is a Linux-based operating system from Hewlett-Packard HP in the United States. A security vulnerability exists in HP ThinPro version 8.1, which originates from an application GUI dialog box that allows unauthorized viewing of files in the file system without proper authorization...

HubSpot 安全漏洞

HubSpot is a customer relationship management platform in the United States. A security vulnerability exists in HubSpot version v1.29441, which stems from improper access control of REST API endpoints and could lead to unauthorized viewing of user data...

PT-2025-44062

Name of the Vulnerable Software and Affected Versions affected versions not specified Description A GUI dialog within an application permits unauthorized viewing of files present in the file system. This occurs due to a lack of appropriate authorization checks when displaying file system contents...

CVE-2025-6639 Tutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments

The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutorassignmentsubmit...

CVE-2025-60936

The open-source web application Emoncms version 11.7.3 is vulnerable to a Cross-Site Scripting (XSS) flaw within its input handling mechanism. This vulnerability allows authenticated attackers with API access to inject malicious JavaScript code. The injected script executes when an administrator ...

CVE-2025-60936

Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism. This vulnerability allows authenticated attackers with API access to inject malicious JavaScript code that executes when administrators view the application logs...