30845 matches found
CVE-2025-6427
An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140...
CVE-2025-41427
WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in Connection Diagnostics page. If a remote authenticated attacker sends a specially crafted request to the affected product, an arbitrary ...
CVE-2025-41427
WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in Connection Diagnostics page. If a remote authenticated attacker sends a specially crafted request to the affected product, an arbitrary ...
CVE-2025-41427
CVE-2025-41427 affects ELECOM WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN (versions up to v1.0.34). The vulnerability is OS command injection on the Connection Diagnostics page caused by improper neutralization of special elements. A remote authenticated attacker can execute arbitrary OS commands...
CVE-2025-52570
Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections TCP, UDP and Unix socket for the services letmeind and letmeinfwd. Therefore, the command line option...
CVE-2025-52570 Letmein connection limiter allows an arbitrary amount of simultaneous connections
Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections TCP, UDP and Unix socket for the services letmeind and letmeinfwd. Therefore, the command line option...
CVE-2025-52570
CVE-2025-52570 affects the Letmein port-knock implementation. Before version 10.2.1, the connection limiter is implemented incorrectly, allowing an arbitrary number of simultaneous incoming connections (TCP, UDP, and Unix socket) for the services letmeind and letmeinfwd. The num-connections optio...
CVE-2025-52570 Letmein connection limiter allows an arbitrary amount of simultaneous connections
Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections TCP, UDP and Unix socket for the services letmeind and letmeinfwd. Therefore, the command line option...
CVE-2025-52570 Letmein connection limiter allows an arbitrary amount of simultaneous connections
Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections TCP, UDP and Unix socket for the services letmeind and letmeinfwd. Therefore, the command line option...
PT-2025-26693 · Unknown · Wrc-X3000Gs
Name of the Vulnerable Software and Affected Versions: WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN affected versions not specified Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This occurs in the...
Elecom多款产品 操作系统命令注入漏洞
Elecom WRC-X3000GS and others are a router from Elecom Japan. An operating system command injection vulnerability exists in the Elecom WRC-X3000GS, Elecom WRC-X3000GSA, and Elecom WRC-X3000GSN, which stems from a Connection Diagnostics page command injection leading to arbitrary OS command...
letmein connection limiter allows an arbitrary amount of simultaneous connections
Impact The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections TCP, UDP and Unix socket for the services letmeind and letmeinfwd. Therefore, the command line option num-connections is not effective and does not limit the number of...
GHSA-JPV7-P47H-F43J letmein connection limiter allows an arbitrary amount of simultaneous connections
Impact The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections TCP, UDP and Unix socket for the services letmeind and letmeinfwd. Therefore, the command line option num-connections is not effective and does not limit the number of...
PT-2025-26665 · Letmein · Letmein
Name of the Vulnerable Software and Affected Versions: Letmein versions prior to 10.2.1 Description: The connection limiter in Letmein is implemented incorrectly, allowing an arbitrary amount of simultaneously incoming connections for the services letmeind and letmeinfwd. This makes the command...
The vulnerability of the PostgreSQL PgBouncer connection pool program, related to authentication process flaws, allows attackers to gain unauthorized access to the application.
The vulnerability of the PgBouncer connection pool program in PostgreSQL involves deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to the application...
Pingora has a Request Smuggling Vulnerability
A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning. Fixed in...
CVE-2025-38075
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection NOPIN response timer may expire on a deleted connection and crash with such logs: Did not receive response to NOPIN on CID: 0, failing connection for IT Nexus...
CVE-2025-38035
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: don't restore null skstatechange queue-statechange is set as part of nvmettcpsetqueuesock, but if the TCP connection isn't established when nvmettcpsetqueuesock is called then queue-statechange isn't set and...
CVE-2025-32879
An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to connect with the device via BLE if no other device is connected. While connected, none of the BLE services and characteristics of the device...