CVE-2025-65815: Improper Limitation of a Pathname to a Restricted Directory

A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC, PPT v65.0 allows attackers to execute a directory traversal...

python-mistralclient-doc-6.1.0-1.1 on GA media (moderate)

python-mistralclient-doc-6.1.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15790-1 Rating: moderate Cross-References: CVE-2021-4472 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

OPENSUSE-SU-2025:15790-1 python-mistralclient-doc-6.1.0-1.1 on GA media

These are all security issues fixed in the python-mistralclient-doc-6.1.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2025-48730

These are all security issues fixed in the python-mistralclient-doc-6.1.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-34350

UnForm Server versions 10.1.15 contain an unauthenticated arbitrary file read and SMB coercion vulnerability in the Doc Flow feature’s 'arc' endpoint. The Doc Flow module uses the 'arc' handler to retrieve and render pages or resources specified by the user-supplied 'pp' parameter, but it does so...

EUVD-2025-199632

UnForm Server versions 10.1.15 contain an unauthenticated arbitrary file read and SMB coercion vulnerability in the Doc Flow feature’s 'arc' endpoint. The Doc Flow module uses the 'arc' handler to retrieve and render pages or resources specified by the user-supplied 'pp' parameter, but it does so...

CVE-2025-34350

UnForm Server versions 10.1.15 contain an unauthenticated arbitrary file read and SMB coercion vulnerability in the Doc Flow feature’s 'arc' endpoint. The Doc Flow module uses the 'arc' handler to retrieve and render pages or resources specified by the user-supplied 'pp' parameter, but it does so...

CVE-2025-34350 UnForm Server < 10.1.15 Doc Flow Unauthenticated File Read

UnForm Server versions 10.1.15 contain an unauthenticated arbitrary file read and SMB coercion vulnerability in the Doc Flow feature’s 'arc' endpoint. The Doc Flow module uses the 'arc' handler to retrieve and render pages or resources specified by the user-supplied 'pp' parameter, but it does so...

CVE-2025-34350 UnForm Server < 10.1.15 Doc Flow Unauthenticated File Read

UnForm Server versions 10.1.15 contain an unauthenticated arbitrary file read and SMB coercion vulnerability in the Doc Flow feature’s 'arc' endpoint. The Doc Flow module uses the 'arc' handler to retrieve and render pages or resources specified by the user-supplied 'pp' parameter, but it does so...

CVE-2025-34350

Summary : CVE-2025-34350 affects UnForm Server

UBUNTU-CVE-2025-13644

MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server...

PT-2025-48076

Name of the Vulnerable Software and Affected Versions UnForm Server versions prior to 10.1.15 Description UnForm Server versions prior to 10.1.15 have an unauthenticated arbitrary file read and SMB coercion issue in the Doc Flow feature’s arc endpoint. The Doc Flow module uses the arc handler to...

Synergetic Data Systems UnForm Server 安全漏洞

Synergetic Data Systems UnForm Server is a document management and print archiving server software from Synergetic Data Systems, USA. A security vulnerability exists in Synergetic Data Systems UnForm Server versions prior to 10.1.15, which stems from an unauthenticated file read and SMB coercion...

CVE-2025-34350: Improper Limitation of a Pathname to a Restricted Directory

UnForm Server versions 10.1.15 contain an unauthenticated arbitrary file read and SMB coercion vulnerability in the Doc Flow feature’s 'arc' endpoint. The Doc Flow module uses the 'arc' handler to retrieve and render pages or resources specified by the user-supplied 'pp' parameter, but it does so...

CVE-2025-63211

A stored cross-site scripting (XSS) vulnerability exists in bridgetech VBC Server & Element Manager firmware versions 6.5.0-9 through 6.5.0-10 . The flaw stems from improper neutralization of input within the addName parameter of the /vbc/core/userSetupDoc/userSetupDoc endpoint. Successful exploi...

CVE-2025-63211

Stored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attackers to execute arbitrary code via the addName parameter to the /vbc/core/userSetupDoc/userSetupDoc endpoint...

python-Scrapy-doc-2.13.3-2.1 on GA media (moderate)

python-Scrapy-doc-2.13.3-2.1 on GA media Announcement ID: openSUSE-SU-2025:15732-1 Rating: moderate Cross-References: CVE-2025-6176 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

CVE-2025-11630

A vulnerability was found in RainyGao DocSys up to 2.02.36. Affected is the function updateRealDoc of the file /Doc/uploadDoc.do of the component File Upload. Performing manipulation of the argument path results in path traversal. The attack can be initiated remotely. The exploit has been made...

CVE-2025-11631

A vulnerability was determined in RainyGao DocSys up to 2.02.36. Affected by this vulnerability is an unknown functionality of the file /Doc/deleteDoc.do. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly...

CVE-2025-11630 RainyGao DocSys File Upload uploadDoc.do updateRealDoc path traversal

A vulnerability was found in RainyGao DocSys up to 2.02.36. Affected is the function updateRealDoc of the file /Doc/uploadDoc.do of the component File Upload. Performing manipulation of the argument path results in path traversal. The attack can be initiated remotely. The exploit has been made...