ESPEC North America Web Controller 3 has a security vulnerability

ESPEC North America Web Controller 3 is a laboratory equipment monitoring software from ESPEC North America, Inc. A security vulnerability exists in ESPEC North America Web Controller versions prior to 3 3.3.8 that originates from user session privileges not being revoked upon logout...

PT-2025-33296 · Espec North America · Espec North America Web Controller

Name of the Vulnerable Software and Affected Versions: ESPEC North America Web Controller versions prior to 3.3.8 Description: The web controller does not revoke user session privileges upon logout via the /api/v4/auth/ endpoint, potentially allowing continued access. Recommendations: Update to...

CVE-2025-27845

ESPEC North America Web Controller 3 versions prior to 3.3.4 are vulnerable to a security flaw where sending an invalid authentication request to the /api/v4/auth/ endpoint results in the disclosure of a JWT secret . This exposure of sensitive information allows an unauthorized actor to obtain el...

CVE-2025-55196

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller, which does not apply a namespace selector. An attacker can access sensitive information from arbitrary...

External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access

Summary A vulnerability was discovered in the External Secrets Operator where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read...

CVE-2025-45315

A cross-site scripting XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter...

CVE-2025-50594

An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account password...

Security Bulletin: Multiple vulnerabilities in IBM Controller

Summary There are vulnerabilities in Open-Source Software OSS components used by IBM Controller. This Security Bulletin relates only to the direct usage of third-party components by IBM Controller and not any nested dependencies within the product. Vulnerability Details CVEID:CVE-2015-6420...

CVE-2025-45315

A cross-site scripting XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter...

CVE-2025-45315

A cross-site scripting XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter...

CVE-2025-50594

An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account password...

CVE-2025-50594

The Danphe Health Hospital Management System EMR version 3.2 is vulnerable to an issue in the /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs component. This vulnerability stems from a weak password recovery mechanism where the system fails to properly verify permissio...

CVE-2025-45315

The hortusfox-web v4.4 software contains a cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint. The root cause is the improper neutralization of input, specifically allowing attackers to inject a crafted payload into the email parameter. Successful exploitation enables ...

CVE-2025-55196: Improper Access Control

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a...

CVE-2025-50594

An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account password...

CVE-2025-8813

A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attac...

CVE-2025-8310

Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password...

CVE-2025-8310

Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password...

New 'Curly COMrades' APT Using NGEN COM Hijacking in Georgia, Moldova Attacks

A previously undocumented threat actor dubbed Curly COMrades has been observed targeting entities in Georgia and Moldova as part of a cyber espionage campaign designed to facilitate long-term access to target networks. "They repeatedly tried to extract the NTDS database from domain controllers --...