CVE-2024-6466

NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified...

Scaling Dynamic Application Security Testing (DAST)

Introduction Microsoft engineering teams use the Security Development Lifecycle to ensure our products are built in alignment with Microsoft’s Secure Future Initiative security principles: Secure by Design, Secure by Default, and Secure Operations. A key component of the Security Development...

CVE-2025-23220

The CVE pertains to WeGIA, an open-source web manager for welfare organizations. A SQL Injection exists in the adicionar_raca.php endpoint (parameter raca), allowing attackers to execute arbitrary SQL and potentially dump the database. This vulnerability has a critical impact (high confidentialit...

CVE-2024-57907

creationtimestamp| type| source ---|---|--- 2025-01-19 11:58:42+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/2345 2025-01-19 12:15:47+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lg3shd2rjy2f 2025-02-18 21:11:31+00:00| seen|...

CVE-2025-21606 Local Privilege Escalation via Exposed XPC Method Due to Client Verification Failure in stats

stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of its XPC service. The application registers a Mach service under the name eu.exelban.Stats.SMC.Helper. The associated binary,...

CVE-2024-39370

creationtimestamp| type| source ---|---|--- 2025-01-14 15:17:06+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfpkaw45ul2f...

CVE-2025-0066 Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)

Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform Internet Communication Framework allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an application...

CVE-2025-23027

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...

CVE-2025-23027 BASEHUB_TOKEN commited in next-forge

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...

Atlassian Jira Service Management Data Center and Server 5.4.x < 5.4.28 / 5.12.x < 5.12.15 / 5.17.x < 5.17.4 / 10.0.x < 10.1.1 XSS (JSDSERVER-15689)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-15689 advisory. - DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has be...

USN-7192-1: xfpt vulnerability

It was discovered that xfpt did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause the application to crash or execute arbitrary code...

CVE-2024-21695

creationtimestamp| type| source ---|---|--- 2025-01-01 00:16:14+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lenbtzeme32i...

CVE-2020-9211

creationtimestamp| type| source ---|---|--- 2024-12-27 10:15:49+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lebqzmjtnv2o 2024-12-27 11:48:39+00:00| seen| https://t.me/cvedetector/13729...

Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

BIT-NODE-MIN-2023-30590

The generateKeys API function returned from crypto.createDiffieHellman only generates missing or outdated keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey. However, the...

CVE-2024-28146

The software Image Access Scan2Net (versions 7.40 and earlier , 7.42 and earlier , and 7.42B and earlier ) is vulnerable to the use of hard-coded credentials . These credentials are utilized to encrypt configuration files during backups, decrypt new firmware during updates, and permit direct conn...

CVE-2024-28140

The Image Access Scan2Net scanning software is vulnerable to a violation of the least privilege principle . By default, the scanner device boots into a kiosk mode that automatically opens the Scan2Net interface in a web browser. This browser, along with several other applications, runs with root ...

CVE-2024-8540

Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application components...

CVE-2024-54198 Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call RFC request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely...

CVE-2024-12057

User credentials login & password are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end. By exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log...