yudao-cloud 授权问题漏洞

yudao-cloud is a backend management system for YunaiV individual developers. An authorization issue vulnerability exists in yudao-cloud version 2025.09 and earlier, which stems from improper authorization of the parameter contactId in the file /crm/contact/transfer, which could lead to remote...

CVE-2025-10275 YunaiV yudao-cloud transfer improper authorization

A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing manipulation of the argument ids/newOwnerUserId can lead to improper authorization. The attack may be launched remotely. The exploit has been made availab...

CVE-2025-20321

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an unauthenticated attacker can send a specially-crafted SPL search that could change the membership state in a Splunk Search Head Cluster SHC...

CVE-2025-53545 Press has a potential 2FA bypass

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit...

PT-2025-28236 · Splunk · Splunk Enterprise +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.4.3 Splunk Enterprise versions prior to 9.3.5 Splunk Enterprise versions prior to 9.2.7 Splunk Enterprise versions prior to 9.1.10 Splunk Cloud Platform versions prior to 9.3.2411.103 Splunk Cloud Platfor...

PT-2025-28235 · Splunk · Splunk Enterprise +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.4.2 Splunk Enterprise versions prior to 9.3.5 Splunk Enterprise versions prior to 9.2.7 Splunk Enterprise versions prior to 9.1.10 Splunk Cloud Platform versions prior to 9.3.2411.104 Splunk Cloud Platfor...

The vulnerability of hybrid cloud solutions for managing thin clients in the Dell Wyse Management Suite, related to errors in request processing, allows a hacker to disclose sensitive information.

The vulnerability of the hybrid cloud solution for managing thin clients in the Dell Wyse Management Suite is related to errors in request processing. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

CVE-2022-50115

CVE-2022-50115 : In the Linux kernel, the ASoC: SOF: ipc3-topology vulnerability caused potential memory corruption due to a double free of ipc_control_data in error/rollback paths when load_bytes-related validation fails. The issue arose because scontrol->ipc_control_data could be freed but n...

CVE-2025-20286 ISE on AWS Static Credential

A vulnerability in Amazon Web Services AWS, Microsoft Azure, and Oracle Cloud Infrastructure OCI cloud deployments of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configuration...

HCL Glovius Cloud 安全漏洞

HCL Glovius Cloud is a modern CAD viewer for Windows, iOS, Android and Web browsers from HCL India. HCL Glovius Cloud has a security vulnerability that stems from the use of an outdated hashing algorithm that could lead to brute force cracking or dictionary attacks...

CVE-2024-45489

Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by default; however because of misconfigured Firebase ACLs, it is possible to create or update a boost using another user's ID. This installs the boost in the victim's browser and...

CVE-2021-29979

Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instance’s primary hosting domain.. This vulnerability affects Hubs Cloud mozillareality/reticulum/1.0.1/20210618012634...

CVE-2021-21984

VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance...

Microsoft Azure 路径遍历漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. A path traversal vulnerability exists in Microsoft Azure. An attacker exploiting this vulnerability can elevate privileges...

Microsoft Azure 访问控制错误漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. An access control error vulnerability exists in Microsoft Azure. An attacker can exploit the vulnerability to elevate privileges. The following products and versions are affected:Azure...

New Cloud Vulnerability Data Shows Google Cloud Leads in Risk

New research shows Google Cloud and smaller providers have the highest cloud vulnerability rates as compared to AWS…...

PT-2025-17159 · Unknown · Cart66 Cloud

Name of the Vulnerable Software and Affected Versions: Cart66 Cloud versions 2.3.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an attacker can inject...

WordPress Cart66 Cloud Plugin <= 2.3.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Cart66 Cloud versions = 2.3.7...

Microsoft Azure 日志信息泄露漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. A log information disclosure vulnerability exists in Microsoft Azure. An attacker exploiting this vulnerability could gain access to sensitive information...

The vulnerability of the ASUS AiCloud cloud platform, which stems from the lack of measures taken to clean data at the management level, allows a hacker to execute arbitrary codes.

The vulnerability of the ASUS AiCloud cloud platform lies in the lack of measures taken at the management level to clean data. Exploiting this vulnerability allows a malicious actor to execute arbitrary codes remotely...