38973 matches found
CVE-2025-49195 No protection against brute-force attacks
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server...
CVE-2025-49195 No protection against brute-force attacks
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server...
CVE-2025-49191
Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The attack is only possible if the attacker is authorized to...
CVE-2025-49193 Missing HTTP Security Headers
The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame Clickjacking attacks or not executing injected malicious JavaScript code XSS attacks...
CVE-2025-49193
Technical details (affected product/versions/root cause/fix) are not publicly provided in the supplied documents; monitor for updates.
CVE-2025-49186
CVE-2025-49186 describes insufficient measures to prevent multiple failed authentication attempts, enabling brute-force attempts. Connected sources tie this to vulnerabilities in SICK Enterprise Analytics and SICK Logistic Analytics products (PSIRT), noting potential impacts to confidentiality an...
AVEVA PI Connector for CygNet
RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to persist arbitrary code in the administrative portal of the product or cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...
PT-2025-25319 · Sick Ag · Sick Field Analytics +1
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The application fails to implement several security headers, which are crucial for increasing the overall security level of the web application. These headers help prevent Clickjacking attac...
CVE-2023-45256
Multiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to execute arbitrary SQL commands via the TPE, societe, MAC, reference, or aliascb parameter to transaction.php, validation.php, or callback.php...
Assessing the Resilience of Automotive Intrusion Detection Systems to Adversarial Manipulation
The security of modern vehicles has become increasingly important, with the controller area network CAN bus serving as a critical communication backbone for various Electronic Control Units ECUs. The absence of robust security measures in CAN, coupled with the increasing connectivity of vehicles,...
PT-2025-25363 · Undefined · Undefined
CVE-2025-27586 Full Disclosure FBRE Attacks against a LN node by theariard in bitcoin 1,079 sats and 1 comment so far https://t.co/dKiwDLupZJ...
PT-2025-25311
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The issue is related to insufficient measures to prevent multiple failed authentication attempts within a short time frame, making the product susceptible to brute-force attacks. Recommendatio...
MAYA: Addressing Inconsistencies in Generative Password Guessing through a Unified Benchmark
Recent advances in generative models have led to their application in password guessing, with the aim of replicating the complexity, structure, and patterns of human-created passwords. Despite their potential, inconsistencies and inadequate evaluation methodologies in prior research have hindered...
ObfusBFA: a Holistic Approach to Safeguarding DNNs from Different Types of Bit-Flip Attacks
Bit-flip attacks BFAs represent a serious threat to Deep Neural Networks DNNs, where flipping a small number of bits in the model parameters or binary code can significantly degrade the model accuracy or mislead the model prediction in a desired way. Existing defenses exclusively focus on...
Amazon Linux 2 : thunderbird (ALAS-2025-2873)
The version of thunderbird installed on the remote host is prior to 128.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2873 advisory. An attacker was able to perform an out-of-bounds read or write on a JavaScript Promise object. This vulnerability...
Amazon Linux 2023 : firefox (ALAS2023-2025-996)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-996 advisory. An attacker was able to perform an out-of-bounds read or write on a JavaScript Promise object. This vulnerability affects Firefox 138.0.4, Firefox ESR 128.10.1, and Firefox ESR 115.23.1...
CVE-2025-5897
A vulnerability was found in vuejs vue-cli up to 5.0.8. It has been rated as problematic. This issue affects the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of the component Markdown Code Handler. The manipulation leads to inefficient regular expression...
Former Black Basta Members Use Microsoft Teams and Python Scripts in 2025 Attacks
Former members tied to the Black Basta ransomware operation have been observed sticking to their tried-and-tested approach of email bombing and Microsoft Teams phishing to establish persistent access to target networks. "Recently, attackers have introduced Python script execution alongside these...
Updated mariadb packages fix security vulnerabilities
MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., and 11.0 through 11.0. can sometimes crash with an empty backtrace log. This may be related to makeaggrtablesinfo and optimizestage2 - CVE-2023-52969. MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through...