CVE-2025-24288

The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts most with sudo access that utilize the same default credentials. By default, Versa director exposes ssh and postgres to the internet, alongside...

CVE-2025-24288

Versa Director (Versa Networks) is affected by CVE-2025-24288. Public details describe multiple issues including exposure of services by default with default credentials (several accounts with sudo) and internet exposure of SSH and PostgreSQL. The root cause centers on weak handling of default cr...

CVE-2025-49591

CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication 2FA in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the...

CVE-2025-49591

CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication 2FA in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the...

SUSE-SU-2025:02013-1 Security update for pam

This update for pam fixes the following issues: - CVE-2025-6018: pamenv: Change the default to not read the user .pamenvironment file bsc1243226. - CVE-2025-6020: pamnamespace: convert functions that may operate on a user-controlled path to operate on file descriptors instead of absolute path...

Malicious code in topomat.controls.ctrlmaster (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f70236b8a23bd596788f7726490e4ac44c5cbcacf88bda2b8adeda33486c14d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-50206

In the Linux kernel, the following vulnerability has been resolved: arm64: fix oops in concurrently setting insnemulation sysctls emulationprochandler changes table-data for procdointvecminmax and can generate the following Oops if called concurrently with itself: | Unable to handle kernel NULL...

PT-2025-26188 · Cryptpad · Cryptpad

Name of the Vulnerable Software and Affected Versions: CryptPad versions prior to 2025.3.0 Description: The issue concerns a weak implementation of access controls in CryptPad, allowing an attacker who compromises a user's credentials to gain access to the victim's account, even if the victim has...

VulnCheck KEV: CVE-2023-1486

A vulnerability classified as problematic was found in Lespeed WiseCleaner Wise Force Deleter 1.5.3.54. This vulnerability affects the function 0x220004 in the library WiseUnlock64.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Local access is...

CVE-2025-49825 Teleport allows remote authentication bypass

Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch...

EUVD-2025-18566

Teleport allows remote authentication bypass...

CVE-2025-43698

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards allows bypass of field level security controls for Salesforce objects. This impacts OmniStudio: before Spring 2025...

Johnson Controls iSTAR Configuration Utility 安全漏洞

The Johnson Controls iSTAR Configuration Utility is a software tool for configuring and managing iSTAR Controllers from Johnson Controls, Inc. A security vulnerability exists in the Johnson Controls iSTAR Configuration Utility that originates from a memory leak that could result in the exposure o...

TOTOLINK X2000R Device Name Parameter Cross-Site Scripting Vulnerability

TOTOLINK X2000R is a wireless router from China's Gion Electronics TOTOLINK. A cross-site scripting vulnerability exists in the TOTOLINK X2000R, which stems from the lack of effective filtering and escaping of user-supplied data by the Device Name parameter in the component Parent Controls Page,...

Schneider Electric Modicon Controllers (Update A)

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

Salesforce OmniStudio 安全漏洞

Salesforce OmniStudio is a digitization platform from US-based Salesforce, Inc. A security vulnerability exists in versions prior to Salesforce OmniStudio Spring 2025 that stems from an improper privilege retention issue that could lead to the bypass of OmniUICard object security controls...

CVE-2025-5649

A vulnerability classified as critical has been found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /admin/core/newuser of the component Register Interface. The manipulation leads to improper access controls. It is possible to initiate the attack...

CVE-2025-20259

Multiple vulnerabilities in the update process of Cisco ThousandEyes Endpoint Agent for Windows could allow an authenticated, local attacker to delete arbitrary files on an affected device. These vulnerabilities are due to improper access controls on files that are in the local file system. An...

WordPress plugin Team Showcase 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A code injection vulnerability exists in WordPress...

CVE-2025-5543

A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726.1108. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Parent Controls Page. The manipulation of the argument Device Name leads to cross site scripting. The attack can be...