CVE-2025-40619 Improper access control vulnerability in Bookgy

Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to reach private areas and/or areas intended for other roles...

PT-2025-18027 · Unknown · Quick Agent V3 +1

Name of the Vulnerable Software and Affected Versions: Quick Agent V3 and Quick Agent V2 affected versions not specified Description: The issue involves an improper limitation of a pathname to a restricted directory, commonly referred to as a Path Traversal issue. If exploited, an arbitrary file ...

Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control...

Harden-Runner allows evasion of 'disable-sudo' policy

Summary Harden-Runner includes a policy option disable-sudo to prevent the GitHub Actions runner user from using sudo. This is implemented by removing the runner user from the sudoers file. However, this control can be bypassed as the runner user, being part of the docker group, can interact with...

CVE-2025-43963

In LibRaw before 0.21.4, phaseonecorrect in decoders/loadmfbacks.cpp allows out-of-buffer access because splitcol and splitrow values are not checked in 0x041f tag processing...

PT-2025-17258 · Yokogawa Electric · Fx1000 +12

Name of the Vulnerable Software and Affected Versions: Yokogawa Electric Corporation GX10 / GX20 / GP10 / GP20 Paperless Recorders versions R5.04.01 or earlier Yokogawa Electric Corporation GM Data Acquisition System versions R5.05.01 or earlier Yokogawa Electric Corporation DX1000 / DX2000 /...

Siemens TeleControl Server Basic SQL

SUMMARY TeleControl Server Basic before V3.1.2.2 contains multiple SQL Injection vulnerabilities that could allow an attacker to read and write to the application's DB, cause denial of service and execute code in an OS shell with limited "NT AUTHORITY\NetworkService" permissions. Siemens has...

National Instruments LabVIEW

RISK EVALUATION Successful exploitation of these vulnerabilities lead to the execution of arbitrary code on affected installations of LabVIEW, which could result in invalid memory writes. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation...

PT-2025-16340

Name of the Vulnerable Software and Affected Versions TOTOLINK A810R version 4.1.2cu.5182 B20201026 Description The issue concerns a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter. This allows for unauthorized execution of commands...

CVE-2025-0125

CVE-2025-0125 affects Palo Alto Networks PAN-OS via the management web interface, where an improper input neutralization vulnerability allows a malicious authenticated read-write administrator to impersonate another legitimate PAN-OS administrator. The issue requires network access to the managem...

INFINITT Healthcare INFINITT PACS

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to upload malicious files and access unauthorized system resources, resulting in arbitrary code execution or information disclosure. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...

PT-2025-15648 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-p4 through 2.4.8-beta2 and earlier Description: The issue is related to an improper access control vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to...

PT-2025-14607 · Caipeichao · Thinkox

Name of the Vulnerable Software and Affected Versions: caipeichao ThinkOX version 1.0 Description: A problematic vulnerability has been found in the Search component of the software. The issue is related to the manipulation of the keywords argument, which leads to cross-site scripting. This can b...

PT-2025-14120 · Yeswiki · Yeswiki

Name of the Vulnerable Software and Affected Versions: YesWiki versions prior to 4.5.2 Description: The issue concerns a path traversal vulnerability in the squelette parameter, allowing unauthorized access to server files. This enables read access to arbitrary files on the server. Recommendation...

CVE-2025-30433

This issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, visionOS 2.4, watchOS 11.4. A shortcut may be able to access files that are normally inaccessible to the...

CVE-2025-30367

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information...

CVE-2024-54559

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data...

CVE-2024-8053 Improper Authentication in open-webui/open-webui

In version v0.3.10 of open-webui/open-webui, the api/v1/utils/pdf endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading...

CVE-2025-1474

Summary: CVE-2025-1474 affects mlflow/mlflow 2.18, where an admin can create a new user account without a password, potentially enabling unauthorized access. The issue is fixed in version 2.19.0. Reports across multiple sources (Red Hat, CIRCL, GHSA, osv, NVD, OSV) corroborate the same descriptio...

Siemens SINEMA Remote Connect Client

SUMMARY SINEMA Remote Connect Client before V3.2 SP3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Client and recommends to update to the latest version. 2. GENERAL RECOMMENDATIONS As a general security measure, Siemens strongly recommends...