CVE-2025-53407

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerabili...

CVE-2025-52429

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerabili...

EUVD-2025-32340

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerabili...

CVE-2025-52429 QTS, QuTS hero

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerabili...

CVE-2025-52429 QTS, QuTS hero

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerabili...

QNAP operating system 格式化字符串错误漏洞

The QNAP operating system is an operating system from Taiwan, China-based QNAP Technology QNAP. A Formatting String Error vulnerability exists in the QNAP operating system, which arises from the use of externally controlled formatting strings that could lead to the acquisition of secret data or...

PT-2025-40587

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.2.6.3195 build 20250715 QNAP QuTS hero versions prior to 5.2.6.3195 build 20250715 Description A use of externally-controlled format string vulnerability exists in QNAP operating systems. If an attacker obtains an...

CVE-2025-41010

CVE-2025-41010 (Hiberus Sintra) describes an incorrect CORS configuration in the Hiberus Sintra service management platform. The vulnerability arises from cross-origin requests when Access-Control-Allow-Credentials is enabled, enabling an attacker to perform privileged actions and access confiden...

Discourse 命令注入漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email and chat rooms. A command injection vulnerability exists in Discourse 3.5.0 and prior versions, which stems from a malicious meta-command that can be...

PT-2025-40244

Name of the Vulnerable Software and Affected Versions Frappe ERPNext version 15.57.5 Description The function get blanket orders at erpnext/controllers/queries.py is susceptible to SQL Injection. An attacker can potentially extract information from databases by injecting a SQL query into the...

FreeBSD : py-mysql-connector-python -- Vulnerability in the MySQL Connectors product of Oracle MySQL (cb570d6f-9ea9-11f0-9446-f02f7497ecda)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cb570d6f-9ea9-11f0-9446-f02f7497ecda advisory. Oracle reports: Vulnerability in the MySQL Connectors product of Oracle MySQL component:...

IMPAQTR Aurora 安全漏洞

IMPAQTR Aurora is a data statistics platform from IMPAQTR Belgium. A security vulnerability exists in IMPAQTR Aurora versions prior to 1.36 that stems from an insecure direct object reference that could lead to access to arbitrary organizational information...

CVE-2025-36262

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of input...

CVE-2025-36262

IBM Planning Analytics Local is affected in versions 2.0.0–2.0.106 and 2.1.0–2.1.13. The issue is due to improper input validation that could allow a malicious privileged user to bypass the UI and access sensitive information. No exploit details are provided in the documents. Remediation is to up...

CVE-2025-55795

The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling a user account with a lower user ID can update their email address to that of another user with ...

PT-2025-40023

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Local versions 2.0.0 through 2.0.106 IBM Planning Analytics Local versions 2.1.0 through 2.1.13 Description A malicious privileged user may be able to bypass the user interface to obtain unauthorized access to sensitive...

Advisory ROSA-SA-2025-3021

software: cjson 1.7.19 AXIS: ROSA-CHROME unaffected versions = cjson-1.7.19-1 affected versions cjson-1.7.19-1 CVE-ID: CVE-2025-57052 BDU-ID: None CVE-Crit: CRITICAL CVE-DESC.: Vulnerability in cJSON 1.5.0-1.7.18: allows a remote attacker to perform array escaping via decodearrayindexfrompointer...

Vulnerabilities fixed in GitLab EE & CE

GitLab has fixed vulnerabilities in GitLab CE/EE Specifically for versions before 18.2.7, 18.3.3, and 18.4.1. The vulnerabilities include allowing authenticated users to access confidential information by creating projects with the same name as the victim, and gaining unauthorized access to...

mysql: mysqldump unspecified vulnerability (CPU Jul 2025)

Vulnerability in the MySQL Client product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise...

mysql: mariadb: mysqldump unspecified vulnerability (CPU Apr 2025)

Vulnerability in the MySQL Client product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise...