CVE-2025-2570: Incorrect Authorization

Mattermost versions 10.5.x = 10.5.3, 9.11.x = 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access ExperimentSettings when RestrictSystemAdmin is true via System Console...

CVE-2025-45746

In ZKT ZKBio CVSecurity 6.4.1R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessible from a local area network, and...

CVE-2025-44039

CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability allows local attackers to connect to the UART port via a serial connection, read all boot sequence, and revealing internal system details and sensitive...

CVE-2025-26662

The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This...

SAP Data Services Management Console Cross-site Scripting Vulnerability

SAP Data Services Management Console is a console for managing and monitoring data services. A cross-site scripting vulnerability exists in SAP Data Services Management Console that stems from the system failing to adequately encode user-controlled input. An attacker could exploit the vulnerabili...

Moderate: iptraf-ng security update

IPTraf-ng is a console-based network monitoring utility which includes an IP traffic monitor, a TCP and UDP service monitor, and a LAN statistics module. It supports Ethernet, FDDI, ISDN, SLIP, PPP, and loopback interfaces as well as the built-in raw socket interface of the Linux kernel. Security...

CVE-2025-44039

The CP-XR-DE21-S -4G Router (Firmware version 1.031.022 ) contains a vulnerability due to insufficient protection of its UART console . This allows a local attacker to establish a serial connection to the UART port and read the entire boot sequence without any authentication. Consequently, the at...

CVE-2025-44039: Missing Authentication for Critical Function

CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability allows local attackers to connect to the UART port via a serial connection, read all boot sequence, and revealing internal system details and sensitive...

CP Plus CP-XR-DE21-S security vulnerabilities

The CP Plus CP-XR-DE21-S is a wireless router from CP Plus. A security vulnerability exists in the CP Plus CP-XR-DE21-S version 1.031.022, which stems from insufficient protection of the UART console and could lead to information disclosure...

CVE-2025-45746: Use of Hard-coded Cryptographic Key

In ZKT ZKBio CVSecurity 6.4.1R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessible from a local area network, and...

CVE-2025-26662: Improper Neutralization of Input During Web Page Generation

The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This...

PT-2025-20904 · Unknown · Cp-Xr-De21-S

Name of the Vulnerable Software and Affected Versions: CP-XR-DE21-S -4G Router Firmware version 1.031.022 Description: The issue concerns insecure protections for the UART console, allowing local attackers to connect via a serial connection, read the boot sequence, and reveal internal system...

CVE-2025-44039

CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability allows local attackers to connect to the UART port via a serial connection, read all boot sequence, and revealing internal system details and sensitive...

CVE-2025-45746

The CVE-2025-45746 issue affects ZKT ZKBio CVSecurity 6.4.1_R, where an unauthenticated attacker can craft a JWT token using a hardcoded secret to authenticate to the service console. This is caused by the hardcoded secret in the JWT authentication flow, enabling access to the service console. Ex...

Fedora 41 : deluge (2025-d23a07ad00)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-d23a07ad00 advisory. https://deluge.readthedocs.io/en/deluge-2.2.0/changelog.html 2.2.0 2025-04-28 Breaking changes Removed Python 3.6 support Python = 3.7 Core Fix GHSL-2024-189...

DEBIAN-CVE-2025-37883

In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Add check for getzeroedpage Add check for the return value of getzeroedpage in sclpconsoleinit to prevent null pointer dereference. Furthermore, to solve the memory leak caused by the loop allocation, add a free helper...

CVE-2025-4272

A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. Affected by this issue is some unknown functionality in the library C:\Program Files\OEM\MECHREVO Control Center\UniwillService\MyControlCenter\csCAPI.dll of the component GCUService. The manipulation...

📄 BeyondTrust Privileged Remote Access 24.3 Takeover

BeyondTrust Privileged Remote Access PRA version 24.3 suffers a privileged login takeover vulnerability due to a passwordless ssh tunnel. === Details ======================================================== Vendor: BeyondTrust Product: Privileged Remote Access PRA Subject: PRA connection takeover...

org.jboss.hal:hal-standalone (>=3.5.0.final, <=3.7.10.final), org.wildfly:wildfly-ee-feature-pack-common (>=28.0.0.beta1, <=28.0.1.final) +3 more potentially affected by CVE-2025-2901 via org.jboss.hal:hal-console (>=3.5.0.final, <=3.7.10.final)

org.jboss.hal:hal-console MAVEN version =3.5.0.final, =3.5.0.final, =28.0.0.beta1, =29.0.0.alpha1, =28.0.0.beta1, =28.0.0.beta1, =36.0.0.final Source cves: CVE-2025-2901 Source advisory: GHSA-F7JH-M6WP-JM7F...

org.jboss.hal:hal-standalone (>=3.5.0.final, <=3.7.10.final), org.wildfly:wildfly-ee-feature-pack-common (>=28.0.0.beta1, <=28.0.1.final) +3 more potentially affected by CVE-2025-2901 via org.jboss.hal:hal-console (>=3.5.0.final, <=3.7.10.final)

org.jboss.hal:hal-console MAVEN version =3.5.0.final, =3.5.0.final, =28.0.0.beta1, =29.0.0.alpha1, =28.0.0.beta1, =28.0.0.beta1, =36.0.0.final Source cves: CVE-2025-2901 Source advisory: OSV:GHSA-F7JH-M6WP-JM7F...