curl: Default Minimum TLS Version Set to TLS v1.0 (Cryptographic Weakness)

Summary: Curl sets TLS v1.0 as the default minimum version, which is outdated and vulnerable to attacks like BEAST, posing a risk to data integrity and confidentiality. This was found through manual code review. No AI was used in identifying the issue or generating this report. Affected Version:...

CVE-2025-5022

Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product measurement unit and display unit to...

Medium: python-crypto

Issue Overview: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data i.e., it does not have semantic security in face of a ciphertext-only attack. The Decisional...

The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in the lack of authentication mechanisms. This allows attackers to gain unauthorized access to protected information.

The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected informati...

CVE-2024-49783

IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data, they could exploit this vulnerability t...

CVE-2024-49783 IBM OpenPages with Watson information disclosure

IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data, they could exploit this vulnerability t...

CVE-2025-7188

CVE-2025-7188 concerns code-projects Chat System 1.0. The vulnerability affects the file /user/addmember.php where manipulating the ID parameter leads to a SQL injection. The issue is exploitable remotely and, according to the CVE entry, the exploit has been disclosed publicly. Multiple connected...

Siemens多款产品 加密问题漏洞

Siemens RUGGEDCOM i800, among others, is a switch from Siemens, a German company. A vulnerability exists in various Siemens products due to an encryption issue that stems from the use of insecure encryption algorithms, which could lead to a man-in-the-middle attack. The following products and...

D-Link DIR-645 注入漏洞

D-Link DIR-645 is a Gigabit wireless router for home and SMB users launched by D-Link in 2012. The D-Link DIR-645 suffers from a command injection vulnerability that stems from the failure of the file /htdocs/cgibin function ssdpcgimain in the component ssdpcgi to correctly filter constructed...

Hugging Face Transformers 安全漏洞

Hugging Face Transformers is Hugging Face's open source advanced natural language processing for Jax, PyTorch and TensorFlow. A security vulnerability exists in Hugging Face Transformers version 4.49.0, which stems from insufficient regular expression complexity in the SETTINGRE variable in...

The vulnerability of the Page and Field Configuration components of the Business Process Management tool in PeopleSoft Enterprise CC Common Application Objects of the Oracle PeopleSoft Products allows a hacker to gain access to read, modify, or delete data.

The vulnerability of the Page and Field Configuration components in the PeopleSoft Enterprise CC Common Application Objects business process management tool from the Oracle PeopleSoft Products family is related to deficiencies in access control. Exploiting this vulnerability could allow an attack...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

weblogic-scan weblogic 漏洞扫描工具 妄想试图weblogic一把梭 目前检测的功能 - x console 页面探测 & 弱口令扫描 - x uuid页面的SSRF - x CVE-2017-10271 wls-wsat页面的反序列化 - x CVE-2018-2628 反序列化 - x CNVD-C-2019-48814 后期可以的话还会继续加功能的，主要是一些反序列化的poc真的不好写，我也不咋会.. USE 使用前请先填写config.py中的server参数...

OESA-2025-1736 sudo security update

Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done. Security Fixes: Sudo before 1.9.17p1, when used with a sudoers file that...

The vulnerability of the cet.c component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the cet.c component in the Linux operating system’s kernel is related to the lack of data security mechanisms. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the Adobe Experience Manager (AEM) content and media data management system lies in the insufficient protection of website structures, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2025-34092

...

CVE-2025-34092

CVE-2025-34092 describes a cookie encryption bypass in Google Chrome’s AppBound mechanism caused by weak path validation in the elevation service. The vulnerability allows an attacker to impersonate Chrome by naming a binary chrome.exe and placing it on a similar path, enabling retrieval of the e...

Nokia Single RAN 安全漏洞

Nokia Single RAN is a wireless network technology from Nokia, Finland. A security vulnerability exists in Nokia Single RAN 23R4-SR prior to version 3.0 MP, which stems from an insufficient authentication mechanism that could lead to elevated privileges...

The vulnerability of the Form_Login() function in the Totolink T6 router’s software allows a intruder to gain unauthorized access to protected information.

The vulnerability of the FormLogin function in the microprogramming software of the TOTOLink T6 system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

CVE-2025-53099 Sentry Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation

Sentry is a developer-first error tracking and performance monitoring tool. Prior to version 25.5.0, an attacker with a malicious OAuth application registered with Sentry can take advantage of a race condition and improper handling of authorization code within Sentry to maintain persistence to a...