Cluster Component Full Control

Vulnerability of the Cluster component: General database management systems like MySQL Cluster are vulnerable due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to gain full control over the application...

Oracle Database Full Control

The vulnerability of the Oracle Database component of the Oracle Database Server system is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain full control over the application...

DRUPAL-CONTRIB-2025-090

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently validate the provided attributes, which makes it possible to insert JavaScript event attributes such as onmouseover,...

CVE-2025-40919 Authen::DigestMD5 versions 0.01 through 0.04 for Perl generate the cnonce insecurely

Authen::DigestMD5 versions 0.01 through 0.02 for Perl generate the cnonce insecurely. The cnonce client nonce is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not...

CVE-2025-40918

The Authen::SASL::Perl::DIGEST_MD5 component in Authen::SASL::Perl (versions 2.04 through 2.1800) insecurely generates the cnonce (client nonce). The vulnerability stems from using an MD5 hash of the PID , epoch time , and the built-in rand function, which is unsuitable for cryptographic use. Bec...

CVE-2025-40923

The Plack-Middleware-Session component for Perl (versions before 0.35 ) generates session IDs insecurely. The root cause is the use of a SHA-1 hash seeded with the built-in rand function (unsuitable for cryptographic use), the epoch time (which may be guessed), and the PID (derived from a small s...

CVE-2025-40919: Generation of Predictable Numbers or Identifiers

Authen::DigestMD5 versions 0.01 through 0.02 for Perl generate the cnonce insecurely. The cnonce client nonce is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not...

PT-2025-29832 · Unknown · Authen::Digestmd5

Name of the Vulnerable Software and Affected Versions: Authen::DigestMD5 versions 0.01 through 0.02 Description: The cnonce client nonce is generated insecurely using an MD5 hash of the PID, the epoch time, and the built-in rand function. The PID originates from a limited set of numbers, and the...

Cryptographic Services Disclosure

The vulnerability of Cryptographic Services in Windows operating systems is related to insufficiently secure data encryption. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

curl: Default Minimum TLS Version Set to TLS v1.0 (Cryptographic Weakness)

Summary: Curl sets TLS v1.0 as the default minimum version, which is outdated and vulnerable to attacks like BEAST, posing a risk to data integrity and confidentiality. This was found through manual code review. No AI was used in identifying the issue or generating this report. Affected Version:...

CVE-2025-5022

Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product measurement unit and display unit to...

Medium: python-crypto

Issue Overview: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data i.e., it does not have semantic security in face of a ciphertext-only attack. The Decisional...

Online Store Authentication Bypass

The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected informati...

CVE-2024-49783

IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data, they could exploit this vulnerability t...

CVE-2024-49783 IBM OpenPages with Watson information disclosure

IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data, they could exploit this vulnerability t...

CVE-2025-7188

CVE-2025-7188 concerns code-projects Chat System 1.0. The vulnerability affects the file /user/addmember.php where manipulating the ID parameter leads to a SQL injection. The issue is exploitable remotely and, according to the CVE entry, the exploit has been disclosed publicly. Multiple connected...

Siemens多款产品 加密问题漏洞

Siemens RUGGEDCOM i800, among others, is a switch from Siemens, a German company. A vulnerability exists in various Siemens products due to an encryption issue that stems from the use of insecure encryption algorithms, which could lead to a man-in-the-middle attack. The following products and...

D-Link DIR-645 注入漏洞

D-Link DIR-645 is a Gigabit wireless router for home and SMB users launched by D-Link in 2012. The D-Link DIR-645 suffers from a command injection vulnerability that stems from the failure of the file /htdocs/cgibin function ssdpcgimain in the component ssdpcgi to correctly filter constructed...

Hugging Face Transformers 安全漏洞

Hugging Face Transformers is Hugging Face's open source advanced natural language processing for Jax, PyTorch and TensorFlow. A security vulnerability exists in Hugging Face Transformers version 4.49.0, which stems from insufficient regular expression complexity in the SETTINGRE variable in...

Page and Field Configuration

The vulnerability of the Page and Field Configuration components in the PeopleSoft Enterprise CC Common Application Objects business process management tool from the Oracle PeopleSoft Products family is related to deficiencies in access control. Exploiting this vulnerability could allow an attack...