CVE-2025-47944

CVE-2025-47944 affects the Multer Node.js multipart/form-data middleware. The vulnerability allows a DoS by sending a malformed multi-part upload, triggering an unhandled exception and crashing the process. It is present in Multer versions from 1.4.4-lts.1 up to, but not including, 2.0.0. The adv...

The vulnerability of the MetadataUploader function in the Visual Composer tool of the SAP NetWeaver software integration platform allows a hacker to execute arbitrary code.

The vulnerability of the MetadataUploader function in the Visual Composer tool of the SAP NetWeaver software integration platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending specially crafted HT...

The vulnerability in the message processing function of the RADIUS authentication, authorization, and accounting protocol implemented by the Cisco Identity Services Engine (ISE) platform for network connection policy management allows a perpetrator to cause a denial-of-service attack on a network access device (NAD).

The vulnerability of the message processing function in the implementation of the RADIUS authentication, authorization, and accounting protocol of the Cisco Identity Services Engine ISE platform is related to reading data beyond the buffer in memory. Exploiting this vulnerability could allow a...

NULL pointer dereference on specially crafted HTTP/2 request

...

Cross-site Scripting (XSS)

Overview org.webjars.bower:bootstrap-multiselect is a JQuery multiselect plugin based on Twitter Bootstrap. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the post.php script. An attacker can execute scripts in the context of the user's browser session by...

libsoup: Out of bounds reads in soup_headers_parse_request()

A flaw was found in libsoup, where the soupheadersparserequest function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server...

The vulnerability of the Ace Editor web interactive query editor in Hue allows a hacker to read arbitrary files.

The vulnerability of the Ace Editor web interactive query editor in Hue is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to read arbitrary files by sending specially crafted HTTP requests...

Improper Access Control

com.baidu.mapp:brcc-core is vulnerable to Improper Access Control. The vulnerability is due to insufficient authorization checks due to the /admin/ API accepting crafted requests that grant unauthorized access to admin functionality...

Dell PowerScale OneFS 缓冲区错误漏洞

Dell PowerScale OneFS is an operating system from Dell USA. PowerScale OneFS operating system that provides horizontal scaling of NAS. An out-of-bounds write vulnerability exists in Dell PowerScale OneFS, which can be exploited by an attacker to submit a special request that could crash the servi...

CVE-2025-20196

A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the Cisco IOx application hosting environment to stop responding, resulting in a denial of service DoS condition. This...

CVE-2025-20190

A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby...

CVE-2025-25014

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints...

CVE-2025-25014 Kibana arbitrary code execution via prototype pollution

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints...

libsoup: Out of bounds reads in soup_headers_parse_request()

A flaw was found in libsoup, where the soupheadersparserequest function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server...

CVE-2025-45607

An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request...

Improper Neutralization Of Escape, Meta, Or Control Sequences

Apache Tomcat is vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences. The vulnerability is due to certain uncommon rewrite rule configurations, specially crafted requests to bypass these rules, which allows an attacker to circumvent security constraints enforced by them...

CVE-2025-44860

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44864

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

Denial of Service (DoS)

Overview org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Denial of Service DoS via specifically crafted search templates with Mustache functions. An attacker can cause the Elasticsearch node to crash by sending malicious...

CVE-2025-44866

CVE-2025-44866 affects the Tenda W20E router. A command injection exists in the formSetDebugCfg function via the level parameter, enabling arbitrary command execution through a crafted request. Affected software: Tenda W20E firmware version 15.11.0.6. Root cause: improper handling/filtering of sp...