139 matches found
CVE-2023-0345
The Akuvox E11 secure shell SSH server is enabled by default and can be accessed by the root user. This password cannot be changed by the user...
Security update for open-vm-tools
This update for open-vm-tools fixes the following issues: Update to 12.5.2: Security fixes: CVE-2025-22247: Fixed Insecure file handling bsc1243106 Other fixes: Fixed GCC 15 compile time error bsc1241938 Fixed building with containerd 1.7.25+ bsc1237147 Ensure vmtoolsd.service and vgauthd.service...
Unveiling the Landscape of LLM Deployment in the Wild: an Empirical Study
Background: Large language models LLMs are increasingly deployed via open-source and commercial frameworks, enabling individuals and organizations to self-host advanced AI capabilities. However, insecure defaults and misconfigurations often expose LLM services to the public Internet, posing...
Digigram PYKO-OUT 安全漏洞
Digigram PYKO-OUT is a professional-grade, multi-channel IP audio encoder from Digigram for high-quality AoIP Audio over IP transmission in broadcast and live production environments. A security vulnerability exists in the Digigram PYKO-OUT, which stems from the fact that no password is required ...
DRUPAL-CONTRIB-2025-028
This module enables users to log in using a short access code instead of providing a username/password combination. The module doesn't sufficiently protect against brute force attacks to guess a user's access code. This vulnerability is mitigated by the fact that access code based logins are off ...
Flowise OverrideConfig security vulnerability
Impact Flowise allows developers to inject configuration into the Chainflow during execution through the overrideConfig option. This is supported in both the frontend web integration and the backend Prediction API. This has a range of fundamental issues that are a major security vulnerability...
PT-2024-23198
Name of the Vulnerable Software and Affected Versions HCL Sametime affected versions not specified Description The issue concerns insecure services in-use on the UIM client by default. Specifically, an unused legacy REST service was enabled by default using the HTTP protocol. This could potential...
CVE-2024-7654
An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other...
PT-2024-40063 · Ez Systems · Ez Platform
Name of the Vulnerable Software and Affected Versions: eZ Platform versions prior to 2.5.4 eZ Platform version 3.0.0 and earlier Description: The issue concerns a potential vulnerability in the eZ Platform log in form, where the Cross-Site Request Forgery CSRF token is present but the CSRF...
SUSE CVE-2024-24989
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3...
SUSE CVE-2017-7537
It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates...
XWiki Platform Cross-Site Scripting Vulnerability
XWiki Platform is a suite of Wiki platforms for creating collaborative Web applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform that stems from the fact that XWiki is susceptible to a reflective cross-site scripting attack when validating the name of...
CVE-2023-5562
An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by...
PT-2023-27606 · Opto 22 · Snap Pac S1 Firmware
Name of the Vulnerable Software and Affected Versions: SNAP PAC S1 Firmware version R10.3b Description: The File Transfer Protocol FTP port is open by default, which could allow an adversary to access some device files. Recommendations: For SNAP PAC S1 Firmware version R10.3b, consider disabling...
CVE-2023-22906
Hero Qubo HCD0102V1.3820220125 devices allow TELNET access with root privileges by default, without a password...
PT-2023-2810 · Mitsubishi · Melsec Ws Series Ws0-Geth00200
Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 versions 2310 and prior Description: The issue allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to it via...
DEBIAN-CVE-2023-24998
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option...
SUSE CVE-2019-9816
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all...
SUSE CVE-2022-2938
A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by default, it could allow an attacker to crash the system or have other memory-corruption side effects...
