CVE-2025-58116

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker...

CVE-2025-55075

CVE-2025-55075 affects I-O DATA WN-7D36QR and WN-7D36QR/UE. A hidden functionality issue may allow a remote authenticated attacker to enable SSH. Impact is that SSH could be enabled remotely (no user interaction required). The issue is exploitable over the network with privileges required as High...

thorium 安全漏洞

thorium is an extensible file analysis and data generation platform from the individual developer mjcarson. A security vulnerability exists in thorium that stems from accepting a zero-valued stream split size and performing a division operation, which could lead to a remote authenticated attacker...

CVE-2025-37127

A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell access. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, potentially...

CVE-2025-37130

A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could allow an attacker to read sensitive data from the underlying file system...

CVE-2025-37128 Authenticated Arbitrary Process Termination allows potential System Disruption in ECOS

A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state...

CVE-2025-37128 Authenticated Arbitrary Process Termination allows potential System Disruption in ECOS

A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state...

CVE-2025-37129

CVE-2025-37129 describes a vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways . An authenticated attacker could exploit the built-in script execution capability to execute arbitrary commands on the underlying operating system if the feature is enabled ...

CVE-2025-37130 Unrestricted Binary allows File Enumeration in Underlying Operating System

A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could allow an attacker to read sensitive data from the underlying file system...

CVE-2025-37130

CVE-2025-37130 affects HPE Aruba EdgeConnect SD-WAN Gateways. A vulnerability in the command-line interface could allow an authenticated attacker to read arbitrary files on the underlying system, exposing sensitive data. The issue is tied to improper access restrictions in the CLI, with the CVSS ...

PT-2025-38090

Name of the Vulnerable Software and Affected Versions: EdgeConnect SD-WAN affected versions not specified Description: A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could...

PT-2025-38089

Name of the Vulnerable Software and Affected Versions: EdgeConnect SD-WAN affected versions not specified Description: A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful...

PT-2025-37753

Name of the Vulnerable Software and Affected Versions: Seafile versions 11.0.18-Pro Seafile versions 12.0.10 Seafile versions 12.0.10-Pro Description: Seafile is susceptible to a stored Cross-Site Scripting XSS attack. An authenticated attacker can exploit this issue by modifying their username t...

CVE-2025-45091

CVE-2025-45091 affects Seafile server components in versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro. The flaw enables stored XSS via an authenticated user altering their username to inject a malicious XSS payload into notifications and activities, leading to script execution when viewed by other u...

CVE-2025-9918

A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server versions 6.3.54.0, 6.3.53.2, and all prior versions allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution RCE via uploading a malicious ZIP archive...

Liferay Portal's selection modal is vulnerable to XSS

A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.2...

GHSA-G8FH-PFW3-8RMR Liferay Portal's selection modal is vulnerable to XSS

A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.2...

CVE-2025-43787

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.2...

CVE-2025-7718

The Resideo Plugin for Resideo - Real Estate WordPress Theme plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.5.4. This is due to the plugin not properly validating a user's identity prior to updating their details like email...

Stored Cross-site Scripting (XSS)

com.liferay, com.liferay.layout.admin.web is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper validation of the comliferaylayoutadminwebportletGroupPagesPortlettype parameter, which allows a remote authenticated attacker to inject and execute malicious JavaScrip...