CVE-2025-58312: Undefined Security Weakness

Permission control vulnerability in the App Lock module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2025-58305: Exposure of Sensitive Information to an Unauthorized Actor

Identity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-66386: Relative Path Traversal

app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin...

Incorrect Implementation of Authentication Algorithm

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm. An attacker can gain unauthorized access to another user's account by leveraging a specially...

Incorrect Implementation of Authentication Algorithm

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to improper validation of OAuth state tokens during the OpenID Connect authentication...

CVE-2025-63434

The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control th...

CVE-2025-63432

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle MITM attack ...

CVE-2025-63435

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official...

CVE-2025-63433

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a static value within the application's code. An attacker with the ability to intercept network traffic can use this hardcoded key to decrypt,...

CVE-2025-13539

creationtimestamp| type| source ---|---|--- 2025-11-27 06:02:50+00:00| seen| https://infosec.exchange/users/offseq/statuses/115620142733448996 2025-11-27 06:02:53+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m6lp3phv5w24 2025-11-27 06:42:41+00:00| seen|...

Exploit for CVE-2021-21980

Clippy of the Dead - CVE-2021-21980 testing environment and Nucl...

Open-Xchange OX App Suite 安全漏洞

Open-Xchange OX App Suite is a productivity application suite from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite that originates from malicious email content executable script code that could lead to the disclosure of sensitive information...

Open-Xchange OX App Suite 安全漏洞

Open-Xchange OX App Suite is a productivity application suite from Open-Xchange, a German company. A security vulnerability exists in Open-Xchange OX App Suite that originates from uploading a malicious file that can execute script code via an attacker-controlled link, potentially leading to the...

Open-Xchange OX App Suite 安全漏洞

Open-Xchange OX App Suite is a productivity application suite from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite that originates from the potential injection of malicious script code when editing documents, which could lead to the disclosure of sensitive...

Open-Xchange OX App Suite 安全漏洞

Open-Xchange OX App Suite is a productivity application suite from Open-Xchange, a German company. A security vulnerability exists in Open-Xchange OX App Suite that originates from uploading a malicious file that can execute script code via an attacker-controlled link, potentially leading to the...

The vulnerability of Azure App Gateway’s load balancer in handling web traffic involves an operation that goes beyond the buffer limits in memory, allowing attackers to exploit their privileges.

The vulnerability of Azure App Gateway’s traffic balancing mechanism is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to gain increased privileges...

The vulnerability of NVIDIA App’s unified management center, related to an uncontrolled search path, allows a perpetrator to elevate their privileges or execute arbitrary code.

The vulnerability of the NVIDIA App’s unified management center is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges or execute arbitrary code...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service [CVE-2025-54121]

Summary Python module starlette is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service. This bulletin provides patch information to address the reported...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service [CVE-2025-64118]

Summary Node.js module tar is used by IBM App Connect Enterprise Certified Container for handling archives files and data. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service [CVE-2025-48924]

Summary Apache Commons Lang is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationRuntime and IntegrationServer operands are vulnerable to denial of service. This bulletin provides patch information to address the...