PT-2025-45703

Summary ZITADEL's Organization V2Beta API contains Insecure Direct Object Reference IDOR vulnerabilities that allow authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations. Impact ZITADEL's Organization V2Beta API,...

CVE-2025-61956

Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and misleading air traffic control ATC and pilots...

CVE-2025-54863

Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data, which could...

CVE-2025-61956

Radiometrics VizAir is affected by a lack of authentication for critical functions (admin panel and REST API). This could allow an unauthenticated attacker to modify configurations and weather data, potentially manipulating active runway settings, misleading air traffic control and pilots, and ca...

CVE-2025-54863 Insufficiently Protected Credentials in Radiometrics VizAir

Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data, which could...

CVE-2025-54863 Insufficiently Protected Credentials in Radiometrics VizAir

Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data, which could...

CVE-2025-54863: Insufficiently Protected Credentials

Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data, which could...

Eval Injection

Overview talkpipe is a Python internal and external DSL for writing generative AI analytics Affected versions of this package are vulnerable to Eval Injection due to using the function eval unsafe in the compileLambda function in the talkpipe/util/datamanipulation.py file. An attacker can execute...

@142vip/midway (>=0.1.6-alpha.9, <=0.1.6-alpha.12), @142vip/nest-starter (>=0.0.1-alpha.1, <=0.0.1-alpha.13) +2729 more potentially affected by CVE-2025-60542 via typeorm (>=0.0.2-alpha.43, <=0.3.25)

typeorm NPM version =0.0.2-alpha.43, =0.1.6-alpha.9, =0.0.1-alpha.1, =0.0.1-alpha.1, =1.0.1, =3.3.4, =1.0.1, =0.0.1, =0.9.3, =1.0.0, =1.1.126, =1.0.0, =1.0.0, =1.0.14 - @actonate/mirkwood 0.10.1 and more Source cves: CVE-2025-60542 Source advisory: SNYK:JS-TYPEORM-13746469...

CVE-2025-41009

SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the database by sending a POST request using the ‘buscame’ parameter in ‘/catalogoc/catalogo.php’...

ProFTPD FTP Server Authentication Manipulation

The vulnerability of the ProFTPD FTP server is related to errors in the authentication process. Exploiting this vulnerability can allow a malicious actor to cause service failures...

ProFTPD FTP Server Authentication Manipulation

The vulnerability of the ProFTPD FTP server is related to errors in the authentication process. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Oracle MySQL Server 8.4.x < 8.4.7 (October 2025 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and...

Vulnerabilities fixed in Oracle PeopleSoft

Oracle has fixed vulnerabilities in Oracle PeopleSoft Specifically for versions 8.60, 8.61, 8.62 and 9.2. The vulnerabilities in Oracle PeopleSoft allow attackers to gain unauthorized access to sensitive data and can lead to data manipulation. This includes vulnerabilities that allow both low- an...

Insecure Direct Object Reference (IDOR)

com.liferay, com.liferay.object.service is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to insufficient access control between virtual instances, which allows an attacker to access, create, edit, or relate data and object entries/definitions across different virtu...

Oracle MySQL 安全漏洞

Oracle MySQL is an open source relational database management system from Oracle Corporation.MySQL Server is one of the database server components. A security vulnerability exists in Oracle MySQL for MySQL Server versions 8.0.0 through 8.0.43, 8.4.0 through 8.4.6, and 9.0.0 through 9.4.0, which...

Oracle PeopleSoft 安全漏洞

Oracle PeopleSoft is a suite of enterprise human capital management solutions from Oracle Corporation USA. The product provides human capital management, financial management, vendor relationship management, and other capabilities. A security vulnerability exists in Oracle PeopleSoft's PeopleSoft...

PT-2025-42955

Name of the Vulnerable Software and Affected Versions Oracle Applications Manager versions 12.2.3 through 12.2.14 Description A flaw exists in the Application Logging Interfaces component of Oracle Applications Manager within Oracle E-Business Suite. An unauthenticated attacker with network acces...

DataEase SQL注入漏洞

DataEase is a set of Java-based development of open source data visualization and analysis tools to help users quickly analyze data and insight into business trends , so as to achieve business improvement and optimization . DataEase /de2api/datasetData/tableField processing tableName parameter...

PT-2025-42626

Name of the Vulnerable Software and Affected Versions DataEase versions through 2.10.13 Description DataEase is a data visualization and analytics platform. A JDBC URL injection vulnerability exists in the DB2 and MongoDB data sources. The issue allows for potential unauthorized access or...