CVE-2025-61865

Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

CVE-2025-61865

CVE-2025-61865 affects I-O DATA NarSuS App and related NAS management applications that register Windows services with unquoted file paths. The underlying issue allows a user with write access to the system drive root to execute arbitrary code with SYSTEM privileges (local impact). Publicly avail...

CVE-2025-61865

Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

PT-2025-43430

Name of the Vulnerable Software and Affected Versions NarSuS App affected versions not specified Description The NarSuS App registers a Windows service using an unquoted file path. This allows a user with write access to the system drive's root directory to potentially execute arbitrary code with...

PT-2025-43453

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A flaw exists in the Framework component of Android operating systems related to insufficient protection of service data. Exploitation may allow a remote attacker to elevate privileges...

I-O DATA NarSuS App 代码问题漏洞

I-O DATA I-O DATA NarSuS App is a desktop software from I-O DATA, Inc. that includes device detection, driver installation, configuration assistance, firmware update, and service registration. I-O DATA I-O DATA NarSuS App suffers from a code issue vulnerability that stems from a Windows service...

PT-2025-43478

In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is...

CVE-2025-62607

creationtimestamp| type| source ---|---|--- 2025-10-22 19:34:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3slnfypam22...

CVE-2025-61220

The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to their personal information...

EUVD-2025-35473

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects AppExperts: from n/a through = 1.4.5...

CVE-2023-53729

creationtimestamp| type| source ---|---|--- 2025-10-22 15:25:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3s5qo5j552c...

CVE-2025-61035

creationtimestamp| type| source ---|---|--- 2025-10-22 14:55:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3s43htaz72u...

Stored Cross-site Scripting (XSS)

Liferay Portal is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization in the remote app title field, which allows an attacker to inject arbitrary web scripts or HTML content that can be executed in a user’s browser...

Multiple I-O DATA NAS management applications register Windows services with unquoted file paths

Overview Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. Multiple NAS management applications provided by I-O DATA DEVICE, INC. contain the following vulnerability. Unquoted search path or element CWE-428 - CVE-2025-61865...

CVE-2025-56800

Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable...

CVE-2025-56799

Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name. NOTE: this is disputed by the Supplier because a crafted folder name would arise only if the local user were attacking himself...

CVE-2025-56801

The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector IV in its AES-CFB encryption implementation allowing attackers with access to the application environment to reliably decrypt encrypted configuration data. NOTE: the Supplier's position is that...

CVE-2025-56799

Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name. NOTE: this is disputed by the Supplier because a crafted folder name would arise only if the local user were attacking himself...

CVE-2025-56800

Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable...

GHSA-8H43-RCQJ-WPC6

creationtimestamp| type| source ---|---|--- 2025-10-21 16:59:24+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115413219015340046 2025-10-21 18:06:39+00:00| seen| https://bsky.app/profile/Whiskeyomega.cupoftea.social.ap.brid.gy/post/3m3pwbdncbss2 2025-10-27 06:09:59+00:00| seen|...