478 matches found
Tenda FH1202 Improper Access Control Vulnerability
The Tenda FH1202 is a wireless router manufactured by Tenda in China. An improper access control vulnerability exists in the Tenda FH1202. The vulnerability stems from improper access control due to the handling of the file /goform/wrlwpsset. An attacker can exploit this vulnerability to launch a...
Moderate: Red Hat Security Advisory: libgcrypt security update
An update for libgcrypt is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
The vulnerability of the SAP NetWeaver Application Server ABAP software integration platform arises from the lack of measures taken to protect the structure of web pages. This vulnerability allows attackers to carry out XSS attacks.
The vulnerability of the SAP NetWeaver Application Server ABAP software integration platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
CVE-2025-2981 Legrand SMS PowerView cross site scripting
A vulnerability, which was classified as problematic, has been found in Legrand SMS PowerView 1.x. This issue affects some unknown processing. The manipulation of the argument redirect leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the publi...
CVE-2025-2920
CVE-2025-2920 affects Netis WF-2404 (firmware 1.1.124EN). The issue involves processing of the file /etc/passwd leading to use of a weak hash. Impact is described as low confidentiality impact with local, physical access required; attack complexity is high and exploitation is difficult. Public di...
CVE-2025-2847 Codezips Gym Management System over_month.php sql injection
A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. This issue affects some unknown processing of the file /dashboard/admin/overmonth.php. The manipulation of the argument mm leads to sql injection. The attack may be initiated remotely. The...
CVE-2024-41643
An issue in Arris NVG443B 9.3.0h3d36 allows a physically proximate attacker to execute arbitrary code via the cshell login component...
CVE-2025-2714 JoomlaUX JUX Real Estate addagent cross site scripting
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /extensions/realestate/index.php/agents/agent-register/addagent. The manipulation of the argument planid leads to cross site scripting. T...
libgcrypt security update
An update is available for libgcrypt. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libgcrypt library provides general-purpose implementations of various...
AZL-58815 CVE-2025-2308 affecting package hdf5 1.14.6-1
A vulnerability, which was classified as critical, was found in HDF5 1.14.6. This affects the function H5Zscaleoffsetdecompressonebyte of the component Scale-Offset Filter. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed...
CVE-2023-38693 RCE in Lucee REST endpoint
Lucee Server or simply Lucee is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173...
Linux Distros Unpatched Vulnerability : CVE-2022-0168
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A denial of service DOS issue was found in the Linux kernel's smb2ioctlqueryinfo function in the fs/cifs/smb2ops.c Common Internet File System CIFS due to an...
CVE-2024-44754
Cryptographic key extraction from internal flash in Minut M2 with firmware version 15142 allows physically proximate attackers to inject modified firmware into any other Minut M2 product via USB...
MAL-2025-1576 Malicious code in cis-photoshop-api-docs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a77d4b1246934467151f8c2fc186f13f5899f16b36f1f32caa547a0908a27edf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-27157
Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on /auth/setup. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 a...
CVE-2025-27157 Mastodon's rate-limits are missing on `/auth/setup`
Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on /auth/setup. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 a...
CVE-2025-1543 iteachyou Dreamer CMS ueditor-1.4.3.3 path traversal
A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3. This issue affects some unknown processing of the file /resource/js/ueditor-1.4.3.3. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed ...
SUSE-SU-2025:0605-1 Security update for openssh
This update for openssh fixes the following issues: - CVE-2025-26465: Fixed MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client bsc1237040...
K000149757: Python vulnerability CVE-2022-0391
Security Advisory Description A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator URL strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the U...