Adtran 411 ONT 安全漏洞

The Adtran 411 ONT is an optical network terminal ONT from Adtran, Inc. It is used to provide fiber-to-the-home FTTH services and support high-speed Internet access. A security vulnerability exists in the Adtran 411 ONT version L80.00.0011.M2, which stems from the inclusion of a weak default...

CVE-2025-2516

CVE-2025-2516 affects Kingsoft WPS Office on Windows, where signature verification uses a weak cryptographic key pair. If the private key is recovered, an attacker could sign components. The issue is compounded by older WPS Office versions not validating the update server certificate, enabling a ...

CVE-2024-13618

The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs...

Kingsoft WPS Office 加密问题漏洞

Kingsoft WPS Office is a kind of office software from Kingsoft China. It provides document processing functionality. Kingsoft WPS Office suffers from a cryptographic issue vulnerability that stems from the use of weak cryptographic key pairs during signature verification, which could lead to an...

GHSA-56P6-QW3C-FQ2G Suspended Directus user can continue to use session token to access API

Summary Since the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to access the API despite their status. Details There is a check missing in verifySessionJWT to verify that a user is actually still active and allowed to...

The vulnerability of the SmartFabric OS10 network operating system, related to deficiencies in access control, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the SmartFabric OS10 network operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of the `sc16is7xx_set_baud()` function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the sc16is7xxsetbaud function in the Linux operating system is related to deficiencies in the segmentation of the system’s controlled areas. Exploiting this vulnerability could allow an attacker to trigger a service failure...

The vulnerability of the x-middleware-subrequest header processing mechanism in the Next.js web application development software platform allows attackers to circumvent existing security restrictions.

The vulnerability of the x-middleware-subrequest header processing mechanism in the Next.js web application development software platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by...

CVE-2024-9070

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions =1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is...

CVE-2025-30472

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orftokenendianconvert in exec/totemsrp.c via a large UDP packet...

jwt-go allows excessive memory allocation during header parsing

Summary Function parse.ParseUnverified currently splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs...

FastChat 代码问题漏洞

FastChat is an open platform from LMSYS for training, deploying and evaluating chatbots based on large-scale language models. A code issue vulnerability exists in FastChat version 0.2.36, which stems from insufficient validation of path parameters and could lead to a server-side request forgery...

PT-2025-12322 · Unknown · Langgenius/Dify

Name of the Vulnerable Software and Affected Versions: langgenius/dify version 0.10.1 Description: A weakness in the pseudo-random number generator PRNG used for generating password reset codes allows an attacker to take over any account, including administrator accounts. The application utilizes...

CVE-2025-2493

creationtimestamp| type| source ---|---|--- 2025-03-18 11:55:39+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/7903 2025-03-18 13:01:22+00:00| seen| Telegram/6cbUuW0XOy9-5cfzVYZy-1D70VP0VBBmnHLM6kTk1XKO28 2025-03-18 16:03:53+00:00| seen| https://t.me/cvedetector/20568 2025-03-18 16:13:23+00:0...

CVE-2025-29779 Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`

Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing VSS scheme. In versions 0.8.0b2 and prior, the secureredundantexecution function in feldmanvss.py attempts to mitigate fault injection attacks by executing a function...

SICK DL100-2xxxxxxx 安全漏洞

The SICK DL100-2xxxxxxxxx is a series of sensors from SICK, Germany. A security vulnerability exists in the SICK DL100-2xxxxxxxxx that stems from the use of a weak hash algorithm to generate a password hash, which could lead to an attacker easily calculating a matching password...

CVE-2025-2107 Arielbrailovsky-Viralad <= 1.0.8 - Unauthenticated SQL Injection

The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the printResultAndDie function in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

The vulnerability of the Golang programming language, related to insufficient protection of sensitive data, allows attackers to gain unauthorized access to user credentials.

The vulnerability of the Golang programming language is related to insufficient protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to account information...

KLA81542 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions, gain privileges. Below is a complete list of vulnerabilities: 1. Type confusion vulnerability in .N...

GHSA-9M63-33Q3-XQ5X Vela Server Has Insufficient Webhook Payload Data Verification

Impact Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit. Any user with access to the CI instance and the linked source control manager can perform the exploit. Method By spoofing a webhook payload with a specific set of headers and body...