CVE-2025-3389

A vulnerability, which was classified as problematic, has been found in hailey888 oasystem up to 2025.01.01. This issue affects the function testMess of the file cn/gson/oasys/controller/inform/InformManageController.java of the component Backend. The manipulation of the argument menu leads to...

PT-2025-15470

Name of the Vulnerable Software and Affected Versions: AOS-10 GW affected versions not specified AOS-8 Controller/Mobility Conductor affected versions not specified Description: Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8...

PT-2025-29033

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A double-free issue was identified in the fsl-mc bus driver within the Linux kernel. A commit intended to simplify deallocation procedures inadvertently introduced a double-free on the...

CVE-2025-27085: Improper Limitation of a Pathname to a Restricted Directory

Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device...

CVE-2025-27084: Improper Neutralization of Input During Web Page Generation

A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting XSS attack. Successful exploitation could enable the attacker to execute arbitrary script code in the victim's browser within the...

PT-2025-15473

Name of the Vulnerable Software and Affected Versions: AOS-10 GW affected versions not specified AOS-8 Controller/Mobility Conductor affected versions not specified Description: Multiple vulnerabilities exist in the web-based management interface of the affected devices. Successful exploitation o...

PT-2025-15357 · Unknown · Mymagicpower Aias

Name of the Vulnerable Software and Affected Versions: mymagicpower AIAS 20250308 Description: A critical issue was found in mymagicpower AIAS, affecting an unknown function of the file 2 training platform/train-platform/src/main/java/top/aias/training/controller/InferController.java. The...

CVE-2025-27083: Improper Neutralization of Special Elements used in a Command

Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful exploitation of these vulnerabilities allows an Authenticated attacker to execute arbitrary commands as a privileged user on the underlying...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a misconfiguration of the xHCI power domain, which could cause the VPU firmware to crash on recovery...

CVE-2025-27082: Unrestricted Upload of File with Dangerous Type

Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlyin...

CVE-2025-3388

A vulnerability classified as problematic was found in hailey888 oasystem up to 2025.01.01. This vulnerability affects the function loginCheck of the file cn/gson/oasys/controller/login/LoginsController.java of the component Frontend. The manipulation of the argument Username leads to cross site...

CVE-2025-3384

A vulnerability was found in 1000 Projects Human Resource Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /controller/employee.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. T...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi China. A security vulnerability exists in RuoYi v.4.8.0, which stems from an elevation of privilege in the editSave method of SysNoticeController...

CVE-2025-3318: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in KenjFrog 肯尼基蛙 company-financial-management 公司财务管理系统 1.0. Affected by this vulnerability is the function page of the file src/main/java/com/controller/ShangpinleixingController.java. The manipulation of the argument sort leads to sql injection. T...

CVE-2025-3249

A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apclicancelwps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The explo...

CVE-2025-3241

A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/com/ukefu/webim/web/handler/admin/callcenter/CallCenterRouterController.java of the component XML Document Handler. The manipulation of the...

PT-2025-14828 · Ruoyi-Ai · Ruoyi-Ai

Name of the Vulnerable Software and Affected Versions: ageerle ruoyi-ai versions 2.0.1 and earlier Description: A critical issue affects an unknown functionality of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysModelController.java in the component's API...

Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities (CVE-2025-24514, CVE-2025-1097, CVE-2025-1098)

Summary IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities where a user that can create or update Ingress objects can use the nginx.ingress.kubernetes.io/auth-url annotation CVE-2025-24514 or the nginx.ingress.kubernetes.io/auth-tls-match-cn...

uberAgent - CVAD Site not visible in Splunk

Splunk dashboard CVAD/DaaS Applications & Desktops does not display CVAD Site on the list. There is no issue with data upload from agent to Splunk as other DDC metrics are available. uberAgent.log file located in C:\Windows\Temp on the Delivery Controller shows the error if you search for:...

CVE-2024-22611

The open-source medical management system OpenEMR version 7.0.2 is vulnerable to SQL Injection . The flaw exists within the following files: \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php, and \openemr\controller.php. This vulnerability could allow an attacker to e...