CVE-2025-6249: Client-Side Enforcement of Server-Side Security

An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions access to application data...

PT-2025-29961 · Filez · Filez

Name of the Vulnerable Software and Affected Versions: FileZ client application affected versions not specified Description: An authentication bypass exists in the FileZ client application. A local attacker with elevated permissions may gain access to application data. Recommendations: At the...

PT-2025-29375 · Go · Github.Com/Lf-Edge/Ekuiper +1

Summary Path traversal is also known as directory traversal. These vulnerabilities enable an attacker to read arbitrary files on the server that is running an application. In this case, an attacker might be able to write to arbitrary files on the server, allowing them to modify application data o...

CVE-2025-45081

Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data...

CVE-2025-45081: Improper Access Control

Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data...

CVE-2025-45081

The IITB SSO single sign-on system, specifically version 1.1.0 , is affected by a security vulnerability involving misconfigured settings . This flaw allows unauthorized attackers to gain access to sensitive application data . To mitigate this risk, users are recommended to reconfigure the settin...

Malicious code in application-data (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db3bf4666074d14ba6a27a4c7851e0abdd35a89b6c5f9833996d9d8b774fd2e3 Any computer that has this package installed or running should be considered...

MAL-2025-5322 Malicious code in application-data (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db3bf4666074d14ba6a27a4c7851e0abdd35a89b6c5f9833996d9d8b774fd2e3 Any computer that has this package installed or running should be considered...

CVE-2025-49192

CVE-2025-49192 is a clickjacking vulnerability affecting SICK Field Analytics and SICK Media Server, where the web UI can be embedded in a frame to mislead users and potentially expose confidential data or enable control gains. The issue is described across multiple sources (SICK PSIRT and relate...

Feng Office 代码问题漏洞

Feng Office formerly known as OpenGoo is an open source online office system by the Feng Office team. The system provides task management, schedule management, document management and Email sending and receiving functions. A code issue vulnerability exists in Feng Office version 3.2.2.1, which...

CVE-2024-50406

A cross-site scripting XSS vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version:...

CVE-2024-50406

A cross-site scripting XSS vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version:...

CVE-2024-50406 License Center

A cross-site scripting XSS vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version:...

CVE-2024-50406 License Center

A cross-site scripting XSS vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version:...

CVE-2024-50406: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version:...

CVE-2024-22128

SAP NWBC for HTML - versions SAPUI 754, SAPUI 755, SAPUI 756, SAPUI 757, SAPBASIS 700, SAPBASIS 701, SAPBASIS 702, SAPBASIS 731, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An unauthenticated attacker can inject malicious javascript to...

CVE-2024-48867

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed the vulnerability in the following version...

CVE-2024-48868

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed the vulnerability in the following version...

CVE-2023-27893

An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems ST-PI - versions 20881700, 20081710, 740, can use a vulnerable interface to execute an application function to perform actions which they...

CVE-2023-44315

A vulnerability has been identified in SINEC NMS All versions V2.0. The affected application improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could prepare a stored cross-site scripting XSS attack that may lead to...