Apple iOS和Apple iPadOS 信息泄露漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS and Apple iPadOS, which arises from the possibility that applications may...

Cross-site Scripting (XSS)

Overview shopxo/shopxo is an e-commerce system. Affected versions of this package are vulnerable to Cross-site Scripting XSS through multiple components. An attacker can manipulate the web application and perform unauthorized actions or access sensitive data by sending crafted requests or injecti...

Security Bulletin: JAVA related vulnerabilities in IBM SP Enterprise Resource Planning (ERP) effected the ERP product.

Summary IBM Storage Protect Enterprise Resource Planning can be affected by security flaws in JAVA. : An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high confidentiality, high integrity impacts, as described in the "Vulnerability Details...

PT-2025-13591 · Onenav · Onenav

Name of the Vulnerable Software and Affected Versions: OneNav version 1.1.0 Description: The issue is related to Server-Side Request Forgery SSRF in custom headers. This means an attacker could potentially force the server to make requests to arbitrary domains, which could lead to unauthorized...

Mozilla Firefox Security Update (MFSA2025-19) - Windows

Mozilla Firefox is prone to a sandbox escape vulnerability SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

CVE-2025-30367 WeGIA SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information...

CVE-2025-27631

The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and update data on the website...

Origin Validation Error

AgentScope is vulnerable to Origin Validation Error. The vulnerability is due to improper access control due to the server not properly restricting access to trusted origins, allowing any external domain to make API requests, leading to unauthorized data access and potential exploitation...

CVE-2025-2332

CVE-2025-2332 affects the WordPress plugin Export All Posts, Products, Orders, Refunds & Users. It allows unauthenticated PHP Object Injection via deserialization in returnMetaValueAsCustomerInput, with impact only if a POP chain exists in a second plugin/theme. Affected versions go up to 2.13; p...

Remote code execution vulnerability in Ingress NGINX Controller (CNVD-2025-05884)

Ingress NGINX Controller is an open source portal controller that uses NGINX as a reverse proxy and load balancer. Ingress NGINX Controller suffers from a remote code execution vulnerability that can be exploited by an attacker to gain access to sensitive data such as credentials and keys across...

Apple macOS Sequoia Information Disclosure Vulnerability

Apple macOS Sequoia is an operating system announced by Apple at the WWDC24 developer conference on June 10, 2024, with the official version launched in the fall of the same year, primarily for Mac devices, emphasizing cross-device collaboration and integration of AI functionality to significantl...

The vulnerability of the Sandbox component in macOS operating systems allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Sandbox component in macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a perpetrator to gain unauthorized access to protected information...

CVE-2025-20230

Summary of CVE-2025-20230 : In Splunk Enterprise, affected versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and in Splunk Cloud Platform’s Splunk Secure Gateway app below 3.8.38 and 3.7.23, a low-privileged user without admin/power roles could edit and delete other users’ data in App KVStore collec...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale Data Access Services (DAS) where service account token configured with risky permission (CVE-2022-22411)

Summary A security vulnerability has been identified in IBM Spectrum Scale Data Access Services DAS where service account token configured with risky permission. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2022-22411 DESCRIPTION: IBM Spectrum Scale could allow an...

Medium: java-23-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12...

Alfasado PowerCMS 注入漏洞

Alfasado PowerCMS is a content management system CMS from Alfasado Japan. Alfasado PowerCMS suffers from an injection vulnerability that originates from an attacker who may be able to exploit the vulnerability to obtain sensitive information or perform malicious actions by injecting special...

Frappe has possibility of SQL injection due to improper validations

Impact An SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Workarounds Upgrading is required, no other workaround is present. Credits Thanks to Thanh of Calif.io for reporting the issue...

CVE-2024-10210

An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL 4.4-005P may allow an authenticated network-based attacker to access data from the file system...

How to Enter the US With Your Digital Privacy Intact

Crossing into the United States has become increasingly dangerous for digital privacy. Here are a few steps you can take to minimize the risk of Customs and Border Protection accessing your data...

OpenDaylight（ODL） 安全漏洞

OpenDaylight ODL is an open source SDN controller from OpenDaylight Open Source. A security vulnerability exists in OpenDaylight ODL Sodium-SR4 and earlier versions, which stems from an insecure Shiro cookie configuration that could lead to a man-in-the-middle attack to access sensitive informati...