CVE-2025-23405

CVE-2025-23405 affects the Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application. The root issue is unauthenticated logging that can affect metrics collection and incident response, with an associated risk of log injection. The NVD/NIST record notes network-exposed co...

CVE-2025-1747

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/login...

CVE-2025-1319 Site Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting

The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2025-22273

CVE-2025-22273 affects CyberArk Endpoint Privilege Manager SaaS v24.7.1. The vulnerability is a lack of rate limiting on the ChangePassword endpoint (/EPMUI/VfManager.asmx/ChangePassword), enabling brute-force attempts on the current password. CVSS v4.0 base score 9.3 (CRITICAL); vector: AV:N/AC:...

Sticky Werewolf Uses Undocumented Implant to Deploy Lumma Stealer in Russia and Belarus

The threat actor known as Sticky Werewolf has been linked to targeted attacks primarily in Russia and Belarus with the aim of delivering the Lumma Stealer malware by means of a previously undocumented implant. Cybersecurity company Kaspersky is tracking the activity under the name Angry Likho,...

CVE-2024-50691

SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certificate errors and is vulnerable to MiTM attacks. Attackers can impersonate the iSolarCloud server and communicate with the Android app...

Brocade ASCG 安全漏洞

Brocade ASCG is a networking feature from Brocade USA that is primarily used to simplify SAN architecture and optimize resource utilization. A security vulnerability exists in Brocade ASCG versions prior to 3.2.0 that stems from not enforcing HSTS and is vulnerable to degradation attacks and...

PT-2025-9116 · Dario Health · Dario Application Database/Internet-Based Server Infrastructure +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue affects metrics gathering and incident response efforts, potentially exposing the risk of injection attacks, such as log injection. Recommendations: At the moment, there is no...

Dario Health USB-C Blood Glucose Monitoring System 安全漏洞

The Dario Health USB-C Blood Glucose Monitoring System is a portable blood glucose monitoring device from Dario Health, Israel. A security vulnerability exists in the Dario Health USB-C Blood Glucose Monitoring System that stems from unauthenticated logs affecting metrics collection and event...

PT-2025-9181

Name of the Vulnerable Software and Affected Versions Paragon Partition Manager version 17 Paragon Partition Manager versions prior to 2.0.0 Description The issue is related to an insecure kernel resource access vulnerability in the BioNTdrv.sys driver, which can be exploited to compromise the...

PT-2025-9137

Name of the Vulnerable Software and Affected Versions Brocade ASCG versions prior to 3.2.0 Description The issue concerns the lack of HTTP Strict Transport Security HSTS enforcement in the web interface, as defined by RFC 6797. HSTS is an optional response header that can be configured on the...

CVE-2024-41335

Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to...

CVE-2024-56811

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system...

CVE-2024-56811

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system...

CVE-2024-56493

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system...

CVE-2024-56496 IBM EntireX information disclosure

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system...

CVE-2024-56811

CVE-2024-56811 affects IBM EntireX 11.1. An information-disclosure vulnerability allows a local user to obtain sensitive data by triggering a detailed technical error message returned by the system. The issue is tied to the error message contents, enabling information leakage that could assist fu...

CVE-2024-56494

IBM EntireX 11.1 contains CVE-2024-56494, a local information-disclosure vulnerability where detailed error messages reveal sensitive information. Affected: IBM EntireX 11.1; root cause: generation of error messages containing sensitive information (CWE-209). CVSSv3.1: 3.3 (LOW). Remediation: app...

Angry Likho APT Resurfaces with Lumma Stealer Attacks Against Russia

Angry Likho APT resurfaces, targeting Russian and Belarusian organizations with Lumma Stealer malware via phishing attacks, stealing credentials, banking data, and more...

Security Bulletin:Vulnerabiilties in swagger-ui and Bootstrap affect watsonx.data

Summary swagger-ui is vulnerable to conduct spoofing attacks. Bootstrap is vulnerable to cross-site scripting. These could affect watsonx.data. Vulnerability Details CVEID:CVE-2018-25031 DESCRIPTION: swagger-ui could allow a remote attacker to conduct spoofing attacks. By persuading a victim to...