HCL Leap 安全漏洞

HCL Leap is a low-code development platform from HCL India. HCL Leap has a security vulnerability that stems from an inadequate default configuration that allows anonymous access to directory information...

PT-2025-17258 · Yokogawa Electric · Fx1000 +12

Name of the Vulnerable Software and Affected Versions: Yokogawa Electric Corporation GX10 / GX20 / GP10 / GP20 Paperless Recorders versions R5.04.01 or earlier Yokogawa Electric Corporation GM Data Acquisition System versions R5.05.01 or earlier Yokogawa Electric Corporation DX1000 / DX2000 /...

UBUNTU-CVE-2025-22097

In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error If the driver initialization fails, the vkmsexit function might access an uninitialized or freed defaultconfig pointer and it might double free it. Fix both possible erro...

Dpanel 安全漏洞

Dpanel is a lightweight Docker visualization management panel open-sourced by Donknap that provides comprehensive container management features. A security vulnerability exists in Dpanel that stems from the inclusion of hardcoded JWT keys in the default configuration, which could lead to host...

[SECURITY] Fedora 42 Update: corosync-3.1.9-3.fc42

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

The vulnerability of the configuration file default.cfg of the Tenda F1202 router microprogramming system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the configuration file default.cfg of the Tenda F1202 router microprogramming system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Suricata 数据伪造问题漏洞

Suricata is a network IDS, IPS, and NSM engine from the Open Information Security Foundation. Suricata suffers from a data forgery issue vulnerability that stems from a default configuration issue that could lead to packet truncation...

CVE-2025-2993

A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14408. Affected by this issue is some unknown functionality of the file /default.cfg. The manipulation of the argument these leads to improper access controls. The attack may be launched remotely. The exploit...

CVE-2025-2993 Tenda FH1202 default.cfg access control

A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14408. Affected by this issue is some unknown functionality of the file /default.cfg. The manipulation of the argument these leads to improper access controls. The attack may be launched remotely. The exploit...

Tenda FH1202 安全漏洞

The Tenda FH1202 is a wireless router manufactured by Tenda. An improper access control vulnerability exists in the Tenda FH1202. The vulnerability stems from improper access control due to manipulation of the parameter 'these' in the file /default.cfg. An attacker could exploit this vulnerabilit...

USN-7283-1 lucene-solr vulnerability

It was discovered that the Apache Solr DataImportHandler module incorrectly handled certain request parameters in a default configuration. A remote attacker could possibly use this issue to execute arbitrary code...

CVE-2025-23359

NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use TOCTOU vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lead to code execution, denial of service,...

AZL-56852 CVE-2025-23359 affecting package nvidia-container-toolkit for versions less than 1.17.4-1

NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use TOCTOU vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lead to code execution, denial of service,...

CVE-2025-23359

The CVE-2025-23359 issue affects the NVIDIA container-toolkit for Linux, where a TOCTOU race under default configuration allows a crafted container image to access the host filesystem, potentially enabling code execution, DoS, privilege escalation, information disclosure, or data tampering. Publi...

CVE-2022-24760

Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution RCE vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution...

CVE-2019-19625

SROS 2 0.8.1 which provides the tools that generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2 leaks node information due to a leaky default configuration as indicated in the policy/defaults/dds/governance.xml document...

GO-2025-3408 WITHDRAWN: DefaultConfig has dangerous defaults causing hung Read in github.com/hashicorp/yamux

This report has been withdrawn with reason: "By request of maintainer in https://github.com/golang/vulndb/issues/3453". The default values for Session.config.KeepAliveInterval and Session.config.ConnectionWriteTimeout of 30s and 10s create the possibility for timed out writes that most aren't...

GO-2025-3410 Insecure default config access in WriteFreely in github.com/writefreely/writefreely

Insecure default config access in WriteFreely in github.com/writefreely/writefreely...

CVE-2025-23205 `frame-ancestors: self` grants all users access to formgrader in nbgrader

nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of enablesubdomai...

nbgrader's `frame-ancestors: self` grants all users access to formgrader

Impact Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of enablesubdomains = False. 1915 disables a protection which would...