36109 matches found
How Attackers Bypass Synced Passkeys
TLDR Even if you take nothing else away from this piece, if your organization is evaluating passkey deployments, it is insecure to deploy synced passkeys. Synced passkeys inherit the risk of the cloud accounts and recovery processes that protect them, which creates material enterprise exposure...
EUVD-2024-55036
Huijietong Cloud Video Platform contains a path traversal vulnerability that allows an unauthenticated attacker can supply arbitrary file paths to the fullPath parameter of the /fileDownload?action=downloadBackupFile endpoint and retrieve files from the server filesystem. VulnCheck has observed...
CVE-2024-13991
CVE-2024-13991 affects Huijietong Cloud Video Platform. The vulnerability is a path traversal / arbitrary file read in the /fileDownload?action=downloadBackupFile endpoint, exploitable by an unauthenticated attacker who can supply arbitrary paths via the fullPath parameter. Multiple sources confi...
CVE-2024-13991 Huijietong Cloud Video Platform fileDownload Arbitrary File Read
Huijietong Cloud Video Platform contains a path traversal vulnerability that allows an unauthenticated attacker can supply arbitrary file paths to the fullPath parameter of the /fileDownload?action=downloadBackupFile endpoint and retrieve files from the server filesystem. VulnCheck has observed...
QNAP Qsync Central SQL Injection Vulnerability (CNVD-2025-27801)
QNAP Qsync Central is a private cloud synchronization service launched by Weilian QNAP, which is mainly used to achieve real-time synchronization and backup of files between devices, with functions similar to GoogleDrive, Dropbox and other cloud storage services, but with the data stored in the...
QNAP Qsync Central Unlimited Resource Allocation Vulnerability (CNVD-2025-30290)
QNAP Qsync Central is the official private cloud synchronization service developed by QNAP for its Network Attached Storage NAS devices. QNAP Qsync Central suffers from an unrestricted resource allocation vulnerability that can be exploited by an attacker to prevent other systems, applications, o...
go-witness 信任管理问题漏洞
go-witness is a Golang library open-sourced by in-toto. A trust management issue vulnerability exists in go-witness version 0.8.6 and earlier, which stems from the AWS attestor not properly validating AWS EC2 instance identity documents, which could lead to the acceptance of forged identity...
Expression Language Injection
Overview Affected versions of this package are vulnerable to Expression Language Injection in route definitions. An attacker with permission to define routes can expose the server's file structure or other sensitive environment variables by crafting a SpEL expression to access sensitive system...
QNAP Qsync Central Uncontrolled Resource Consumption Vulnerability
QNAP Qsync Central is the official private cloud synchronization service developed by QNAP for its Network Attached Storage NAS devices. QNAP Qsync Central suffers from an uncontrolled resource consumption vulnerability that can be exploited by attackers to cause a denial of service...
Adobe Creative Cloud Desktop 安全漏洞
Adobe Creative Cloud Desktop is a suite of applications for managing applications and services in the Creative Cloud Member Management Center from the American company Audobee Adobe. The program supports synchronizing and sharing files, managing fonts, and accessing asset libraries for commercial...
QNAP Qsync Central Unrestricted Resource Allocation Vulnerability (CNVD-2025-30288)
QNAP Qsync Central is the official private cloud synchronization service developed by QNAP for its Network Attached Storage NAS devices. QNAP Qsync Central suffers from an unrestricted resource allocation vulnerability that can be exploited by an attacker to prevent other systems, applications, o...
EUVD-2025-34336
Time-of-check time-of-use toctou race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...
EUVD-2025-34420
Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally...
EUVD-2024-55033
A insertion of sensitive information into sent data in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiVoice 7.0.0 through 7.0.4, 6.4.0 through 6.4.9, 6.0.7 through 6.0.12, FortiMail 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.9, FortiOS 7.6.0, 7.4.0 through 7.4.4, 7.2.0...
CVE-2025-55680
Time-of-check time-of-use toctou race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...
CVE-2025-55680
Time-of-check time-of-use toctou race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...
CVE-2025-55336
Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally...
CVE-2025-55336
Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally...
CVE-2025-55680
CVE-2025-55680 concerns a TOCTOU race condition in the Windows Cloud Files Mini Filter Driver that can enable an authorized attacker to achieve local privilege escalation. The available connected docs confirm the affected component (Windows Cloud Files Mini Filter Driver) and the privilege impact...
