PT-2025-21837 · Unknown · Weibocom Rill-Flow

Name of the Vulnerable Software and Affected Versions: weibocom rill-flow version 0.1.18 Description: A critical issue has been found, affecting an unknown function of the Management Console component. This issue leads to code injection and can be exploited remotely. The exploit has been disclose...

Rill Flow 注入漏洞

Rill Flow is a high-performance, scalable workflow orchestration engine open-sourced by Weibo R&D Open Source Projects for distributed workloads and LLM. An injection vulnerability exists in Rill Flow version 0.1.18, which stems from code injection in the component Management Console...

ruby3.4-rubygem-web-console-4.2.1-1.7 on GA media (moderate)

ruby3.4-rubygem-web-console-4.2.1-1.7 on GA media Announcement ID: openSUSE-SU-2025:15129-1 Rating: moderate Cross-References: CVE-2015-3224 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

CVE-2025-4866: Improper Control of Generation of Code

A vulnerability was found in weibocom rill-flow 0.1.18. It has been classified as critical. Affected is an unknown function of the component Management Console. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and...

OPENSUSE-SU-2025:15129-1 ruby3.4-rubygem-web-console-4.2.1-1.7 on GA media

These are all security issues fixed in the ruby3.4-rubygem-web-console-4.2.1-1.7 package on the GA media of openSUSE Tumbleweed...

pcs security update

0.11.9-2 - Fixed restarting bundles Resolves: RHEL-79055 - Fixed deletion of misconfigured bundles Resolves: RHEL-79160 - Fixed filtering of resource clones in web console Resolves: RHEL-78653 - Updated bundled rubygem rack Resolves: RHEL-79500 0.11.9-1 - Rebased pcs to the latest sources see...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the ExperimentalSettings function. An attacker can exploit this issue by accessing unauthorized settings through the System Console. Note: This is only exploitable if the RestrictSystemAdmin setting is true,...

CVE-2025-2570

Mattermost versions 10.5.x = 10.5.3, 9.11.x = 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access ExperimentSettings when RestrictSystemAdmin is true via System Console...

CVE-2025-26662

The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This...

CVE-2025-44039

CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability allows local attackers to connect to the UART port via a serial connection, read all boot sequence, and revealing internal system details and sensitive...

CVE-2025-2570: Incorrect Authorization

Mattermost versions 10.5.x = 10.5.3, 9.11.x = 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access ExperimentSettings when RestrictSystemAdmin is true via System Console...

CVE-2025-45746

In ZKT ZKBio CVSecurity 6.4.1R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessible from a local area network, and...

CVE-2025-44039

CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability allows local attackers to connect to the UART port via a serial connection, read all boot sequence, and revealing internal system details and sensitive...

CVE-2025-26662

The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This...

SAP Data Services Management Console 跨站脚本漏洞

SAP Data Services Management Console is a console for managing and monitoring data services. A cross-site scripting vulnerability exists in SAP Data Services Management Console that stems from the system failing to adequately encode user-controlled input. An attacker could exploit the vulnerabili...

CVE-2025-45746

The CVE-2025-45746 issue affects ZKT ZKBio CVSecurity 6.4.1_R, where an unauthenticated attacker can craft a JWT token using a hardcoded secret to authenticate to the service console. This is caused by the hardcoded secret in the JWT authentication flow, enabling access to the service console. Ex...

CVE-2025-44039

The CP-XR-DE21-S -4G Router (Firmware version 1.031.022 ) contains a vulnerability due to insufficient protection of its UART console . This allows a local attacker to establish a serial connection to the UART port and read the entire boot sequence without any authentication. Consequently, the at...

Moderate: iptraf-ng security update

IPTraf-ng is a console-based network monitoring utility which includes an IP traffic monitor, a TCP and UDP service monitor, and a LAN statistics module. It supports Ethernet, FDDI, ISDN, SLIP, PPP, and loopback interfaces as well as the built-in raw socket interface of the Linux kernel. Security...

CVE-2025-44039

CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability allows local attackers to connect to the UART port via a serial connection, read all boot sequence, and revealing internal system details and sensitive...

CP Plus CP-XR-DE21-S 安全漏洞

The CP Plus CP-XR-DE21-S is a wireless router from CP Plus. A security vulnerability exists in the CP Plus CP-XR-DE21-S version 1.031.022, which stems from insufficient protection of the UART console and could lead to information disclosure...