6178 matches found
PT-2025-15508
Name of the Vulnerable Software and Affected Versions Windows Media affected versions not specified Description A heap-based buffer overflow exists in Windows Media. This issue allows an authorized attacker to execute code locally, and remote attackers to execute arbitrary code, potentially...
PT-2025-15543 · Microsoft · Windows Universal Plug/Play (Upnp) Device Host +1
Name of the Vulnerable Software and Affected Versions: Windows Universal Plug and Play UPnP Device Host affected versions not specified Description: The issue concerns sensitive data storage in improperly locked memory, allowing an authorized attacker to elevate privileges over a network. This ca...
PT-2025-15496 · Microsoft · Windows Digital Media +1
Name of the Vulnerable Software and Affected Versions: Windows Digital Media affected versions not specified Description: The issue is related to a use after free condition in Windows Digital Media, which can be exploited by an authorized attacker to elevate privileges locally. Recommendations: A...
PT-2025-15558 · Microsoft · Windows Virtualization-Based Security (Vbs) Enclave +1
Name of the Vulnerable Software and Affected Versions: Windows Virtualization-Based Security VBS Enclave affected versions not specified Description: The issue is related to insufficient verification of data authenticity, allowing an authorized attacker to bypass a security feature locally. There...
PT-2025-15070 · Zammad · Zammad
Name of the Vulnerable Software and Affected Versions: Zammad versions 6.4.0 through 6.4.1 Description: The issue allows an authenticated agent with knowledge base permissions to use the Zammad API to fetch knowledge base content that they have no permission for. Recommendations: For versions 6.4...
CVE-2025-29815
Use after free in Microsoft Edge Chromium-based allows an authorized attacker to execute code over a network...
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Use after free in Microsoft Edge Chromium-based allows an authorized attacker to execute code over a network...
CVE-2025-3082 User may override a view's collation and gain unauthorized access to underlying data
A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version...
CVE-2025-30802
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPBean Our Team Members our-team-members.This issue affects Our Team Members: from n/a through = 2.2...
CVE-2025-29635
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/setprohibiting via the corresponding function, triggering remote command execution...
CVE-2025-29635
CVE-2025-29635 is a command-injection vulnerability in D-Link DIR-823X 240126–240802 that can be triggered by a POST to /goform/set_prohibiting, enabling remote command execution by an authenticated attacker. Connected sources document a Mirai-family campaign actively exploiting this flaw to depl...
How to Create a Scan in Perl to Identify Vulnerable POP3 Servers
This paper, written in Brazilian Portuguese, explains how to create a Perl script to identify vulnerable POP3 servers. In the context of application security, the author provides mitigation recommendations...
Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
Improper link resolution before file access 'link following' in Microsoft Edge Chromium-based allows an authorized attacker to elevate privileges locally...
CVE-2025-29807
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network...
PT-2025-28209
Name of the Vulnerable Software and Affected Versions: MongoDB Server version 8.1.0 Description: An authorized user can issue queries with duplicate id fields, leading to unexpected behavior in MongoDB Server, which may result in a crash. This issue can only be triggered by authorized users and...
PT-2025-12385 · Microsoft · Dataverse
Name of the Vulnerable Software and Affected Versions: Microsoft Dataverse affected versions not specified Description: Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. Recommendations: At the moment, there is no information...
SUSE CVE-2024-40635
containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as roo...
CVE-2025-24997
Null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service locally...