CVE-2025-27846

In ESPEC North America Web Controller 3 before 3.3.8, an attacker with physical access can gain elevated privileges because GRUB and the BIOS are unprotected...

PT-2025-33287 · Espec North America · Espec North America Web Controller

Name of the Vulnerable Software and Affected Versions: ESPEC North America Web Controller versions prior to 3.3.4 Description: An invalid authentication request to /api/v4/auth/ exposes a JWT secret, potentially allowing for elevated permissions to the user interface. Recommendations: Update ESPE...

ESPEC North America Web Controller 3 has a security vulnerability

ESPEC North America Web Controller 3 is a laboratory equipment monitoring software from ESPEC North America. A security vulnerability exists in ESPEC North America Web Controller versions prior to 3 3.3.8 that stems from an unprotected GRUB and BIOS, where physical access could result in elevated...

CVE-2025-27847

The ESPEC North America Web Controller 3 (versions prior to 3.3.8 ) is vulnerable to improper privilege management because user session privileges are not revoked upon logout via the /api/v4/auth/ endpoint. This flaw potentially allows for continued access to the system after a user has signed ou...

ESPEC North America Web Controller 3 has a security vulnerability

ESPEC North America Web Controller 3 is a laboratory equipment monitoring software from ESPEC North America, Inc. A security vulnerability exists in ESPEC North America Web Controller versions prior to 3 3.3.8 that originates from user session privileges not being revoked upon logout...

CVE-2025-27845

In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret. This allows for elevated permissions to the UI...

CVE-2025-27845

ESPEC North America Web Controller 3 versions prior to 3.3.4 are vulnerable to a security flaw where sending an invalid authentication request to the /api/v4/auth/ endpoint results in the disclosure of a JWT secret . This exposure of sensitive information allows an unauthorized actor to obtain el...

CVE-2025-27846

The ESPEC North America Web Controller 3 laboratory equipment monitoring software is vulnerable in versions prior to 3.3.8 . Due to unprotected GRUB and BIOS , an attacker with physical access can exploit the system to gain elevated privileges . To remediate this vulnerability, it is recommended ...

PT-2025-33295 · Espec North America · Espec North America Web Controller 3

Name of the Vulnerable Software and Affected Versions: ESPEC North America Web Controller 3 versions prior to 3.3.8 Description: An attacker with physical access can gain elevated privileges due to the lack of protection for GRUB and the BIOS. Recommendations: Update ESPEC North America Web...

ESPEC North America Web Controller 3 has a security vulnerability

ESPEC North America Web Controller 3 is a laboratory equipment monitoring software from ESPEC North America. A security vulnerability exists in ESPEC North America Web Controller versions prior to 3 3.3.4, which stems from an invalid authentication request resulting in a JWT key disclosure that...

CVE-2025-55196

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a...

External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access

Summary A vulnerability was discovered in the External Secrets Operator where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller, which does not apply a namespace selector. An attacker can access sensitive information from arbitrary...

CVE-2025-45315

A cross-site scripting XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter...

CVE-2025-50594

An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account password...

Security Bulletin: Multiple vulnerabilities in IBM Controller

Summary There are vulnerabilities in Open-Source Software OSS components used by IBM Controller. This Security Bulletin relates only to the direct usage of third-party components by IBM Controller and not any nested dependencies within the product. Vulnerability Details CVEID:CVE-2015-6420...

CVE-2025-50594

An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account password...

CVE-2025-45315

The hortusfox-web v4.4 software contains a cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint. The root cause is the improper neutralization of input, specifically allowing attackers to inject a crafted payload into the email parameter. Successful exploitation enables ...

CVE-2025-50594

The Danphe Health Hospital Management System EMR version 3.2 is vulnerable to an issue in the /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs component. This vulnerability stems from a weak password recovery mechanism where the system fails to properly verify permissio...

CVE-2025-45315

A cross-site scripting XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter...