CRMEB 代码问题漏洞

CRMEB is a Java mall system . CRMEB 5.6.1 and previous versions of server-side request forgery vulnerability , the vulnerability stems from the file app/services/out/OutAccountServices.php parameter pushtokenurl does not implement a sufficient authentication mechanism to confirm the source of the...

Linux Distros Unpatched Vulnerability : CVE-2023-41900

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty...

Linux Distros Unpatched Vulnerability : CVE-2025-24070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network. CVE-2025-24070 Note that Nessus relies...

CVE-2025-50173

Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally...

IBM 2025 Cost of a Data Breach Report: Lessons for API and AI Security

IBM’s 2025 Cost of a Data Breach Report offers one of the clearest and most comprehensive views yet of how AI adoption is shaping the security landscape. While breach numbers are relatively low – only 13% of organizations reported breaches involving AI models or applications – the report reveals ...

CVE-2025-50173

Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2025-50173

Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2025-50173

CVE-2025-50173 is a Windows Installer local privilege-escalation vulnerability caused by weak authentication that enables an authenticated, local attacker to elevate privileges. The CVE is documented with a CVSS v3.1 base score of 7.8 (Impact: High; Privileges Required: Low; Scope: Unchanged; Loc...

CVE-2025-40743

A vulnerability has been identified in SINUMERIK 828D PPU.4 All versions V4.95 SP5, SINUMERIK 828D PPU.5 All versions V5.25 SP1, SINUMERIK 840D sl All versions V4.95 SP5, SINUMERIK MC All versions V1.25 SP1, SINUMERIK MC V1.15 All versions V1.15 SP5, SINUMERIK ONE All versions V6.25 SP1, SINUMERI...

Windows Installer Elevation of Privilege Vulnerability

Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally...

The vulnerability of the get_details() function in the POST SMTP plugin of the WordPress content management system allows a hacker to escalate their privileges and disclose sensitive information.

The vulnerability of the getdetails function in the POST SMTP Mailer plugin of the WordPress content management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to increase their privileges and disclose sensitive...

Adobe ColdFusion Server-Side Request Forgery Vulnerability

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion has a server-side request forgery vulnerability, the vulnerability stems from the serv...

Drupal Mail Login 安全漏洞

Drupal Mail Login is an email address login plugin for the Drupal community. A security vulnerability exists in Drupal Mail Login versions prior to 3.2.0 and prior to 4.2.0, which stems from an improperly restricted authentication attempt that could lead to a brute force cracking attack...

CVE-2025-47995

Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network...

Emby Windows 代码问题漏洞

Emby Windows is a media playback application for the Windows platform developed by Emby LLC that supports Windows 10, 11 and later systems. Emby Windows suffers from a server-side request forgery vulnerability that stems from the server not implementing an adequate authentication mechanism to...

CVE-2025-47995

Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network...

WordPress WP Compress Weak Authentication Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A weak authentication vulnerability exists in WordPress WP Compress, which stems from a weak authentication mechanism, and no detailed vulnerability details are provided at...

CVE-2025-1727

CVE-2025-1727 describes a weakness in the End-of-Train/Head-of-Train (EoT/HoT) remote linking protocol that relies on a BCH checksum. The Red Hat entry and other sources mirror the NVD description: an attacker with appropriate access could craft EoT/HoT packets (via software‑defined radio) and is...

CVE-2025-1727 End-of-Train and Head-of-Train Remote Linking Protocol Weak Authentication

The protocol used for remote linking over RF for End-of-Train and Head-of-Train also known as a FRED relies on a BCH checksum for packet creation. It is possible to create these EoT and HoT packets with a software defined radio and issue brake control commands to the EoT device, disrupting...

CVE-2025-1727 End-of-Train and Head-of-Train Remote Linking Protocol Weak Authentication

The protocol used for remote linking over RF for End-of-Train and Head-of-Train also known as a FRED relies on a BCH checksum for packet creation. It is possible to create these EoT and HoT packets with a software defined radio and issue brake control commands to the EoT device, disrupting...