14146 matches found
CVE-2024-53946
The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery CSRF on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in...
CVE-2025-7774
CVE-2025-7774 affects the Rockwell Automation 5032 16pt Digital Configurable module, specifically its web server. The root issue is that intercepted session credentials can be reused within a short 3‑minute timeout window to perform privileged actions. This vulnerability arises from session handl...
CVE-2025-7774 Rockwell Automation ArmorBlock 5000 I/O – Web Server Vulnerabilities
A security issue exists within the 5032 16pt Digital Configurable module’s web server. Intercepted session credentials can be used within a 3-minute timeout window, allowing unauthorized users to perform privileged actions...
PT-2025-33292
Name of the Vulnerable Software and Affected Versions: FactoryTalk Linx Network Browser affected versions not specified Description: A security issue exists within the FactoryTalk Linx Network Browser. Modifying the process.env.NODE ENV environment variable to ‘development’ disables FTSP token...
SourceCodester Cashier Queuing System SQL注入漏洞
SourceCodester Cashier Queuing System is an open source cashier queuing system from SourceCodester. A security vulnerability exists in SourceCodester Cashier Queuing System version 1.0, which originates from a SQL injection due to incorrect manipulation of the parameter Username in the file...
PT-2025-33340 · Unknown +2 · Homeassistant-Tapo-Control +3
Name of the Vulnerable Software and Affected Versions: HomeAssistant-Tapo-Control versions prior to commit 2a3b80f Description: HomeAssistant-Tapo-Control, a component offering control for Tapo cameras within Home Assistant, contained a code injection vulnerability in the GitHub Actions workflow...
PT-2025-33276 · Unknown · 5032 16Pt Digital Configurable Module
Name of the Vulnerable Software and Affected Versions: 5032 16pt Digital Configurable module affected versions not specified Description: A security issue exists within the web server of the 5032 16pt Digital Configurable module. Intercepted session credentials can be reused within a 3-minute...
CVE-2024-53946
The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery CSRF on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in...
CVE-2024-53946
The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery CSRF on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in...
CVE-2024-53946
CVE-2024-53946 concerns the KuWFi 4G LTE AC900 router (version 1.0.13). The core issue is Cross-Site Request Forgery (CSRF) on the router’s web management interface, which can coerce an authenticated admin into performing unintended actions. Documents also reference exploitation of a command inje...
m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials
Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory e.g., due to a local Git repo, custom project structure, or via the actions/checkout...
PT-2025-34541 · Github Actions · Boldestdungeon/Steam-Workshop-Deploy +1
Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory e.g., due to a local Git repo, custom project structure, or via the actions/checkout...
JetBrains TeamCity 2023.11.4 - Authentication Bypass
!/usr/bin/env python3 -- coding: utf-8 -- """ Exploit Title: JetBrains TeamCity 2023.11.4 - Authentication Bypass Date: 2024-02-21 Exploit Author: ibrahimsql https://github.com/ibrahimsql Vendor Homepage: https://www.jetbrains.com/teamcity/ Version: =2.25.1 """ import requests import argparse...
Improper Authorization
Overview Affected versions of this package are vulnerable to Improper Authorization over the /auth/listprojects endpoint. A user can perform unauthorized actions beyond their intended permissions by changing the role argument from Viewer to Owner. Remediation There is no fixed version for...
CVE-2025-54594
react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actions repository workflow improperly used the pullrequesttarget event trigger, which allowed for untrusted code from a forked pull request to...
PT-2025-32237 · Suitecrm · Suitecrm
Name of the Vulnerable Software and Affected Versions: SuiteCRM versions 7.14.0 through 7.14.6 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. A Cross Site Scripting XSS vulnerability exists in the email viewer. An external...
wifi: iwlwifi: fix debug actions order
...
BIT-MLFLOW-2025-1473 CSRF in mlflow/mlflow
A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...
CVE-2025-54594 react-native-bottom-tabs: Arbitrary code execution in GitHub Actions canary workflow leads to secret exfiltration
react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actions repository workflow improperly used the pullrequesttarget event trigger, which allowed for untrusted code from a forked pull request to...