CVE-2025-40737

A vulnerability has been identified in SINEC NMS All versions V4.0. The affected application does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted locations and potentially execute code with elevated privilege...

CVE-2025-40738

A vulnerability has been identified in SINEC NMS All versions V4.0. The affected application does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted locations and potentially execute code with elevated privilege...

CVE-2025-40738

Siemens SINEC NMS before v4.0 is affected by a path traversal vulnerability due to improper ZIP file path validation when extracting uploaded ZIPs. The issue allows writing arbitrary files to restricted locations and could enable elevated-privilege code execution (ZDI-CAN-26572). Evidence across ...

CVE-2025-40737

CVE-2025-40737 affects Siemens SINEC NMS versions prior to 4.0. The issue is a path traversal/ZIP extraction flaw where file paths are not properly validated, allowing an attacker to write arbitrary files to restricted locations and potentially achieve code execution with elevated privileges (ZDI...

Microsoft Graphics Component 安全漏洞

Microsoft Graphics Component is a graphics driver component from Microsoft Corporation USA. A security vulnerability exists in Microsoft Graphics Component. An attacker could exploit this vulnerability to gain elevated privileges. The following products and versions are affected: Windows 10 Versi...

Microsoft Brokering File System 资源管理错误漏洞

Microsoft Brokering File System is a file system from Microsoft Corporation USA. A resource management error vulnerability exists in Microsoft Brokering File System. An attacker could exploit this vulnerability to gain elevated privileges. The following products and editions are affected: Windows...

Microsoft Windows 资源管理错误漏洞

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. Microsoft Windows has a security vulnerability. The vulnerability can be exploited by an attacker to gain elevated privileges...

PT-2025-29961 · Filez · Filez

Name of the Vulnerable Software and Affected Versions: FileZ client application affected versions not specified Description: An authentication bypass exists in the FileZ client application. A local attacker with elevated permissions may gain access to application data. Recommendations: At the...

Microsoft Windows 资源管理错误漏洞

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. Microsoft Windows has a security vulnerability. The vulnerability can be exploited by an attacker to gain elevated privileges...

Citrix Virtual Apps and Desktops 安全漏洞

Citrix Virtual Apps and Desktops is a virtualization software from Citrix Corporation, USA. A security vulnerability exists in Citrix Virtual Apps and Desktops that stems from improper privilege management and could lead to elevated privileges...

SAP SAPCAR 安全漏洞

SAP SAPCAR is a utility program for compressing and/or decompressing SAP archive files from SAP, Germany. A security vulnerability exists in SAP SAPCAR that stems from the ability of an elevated privilege user to create malicious SAR archives that could result in elevated privileges...

Microsoft Windows 资源管理错误漏洞

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. Microsoft Windows has a security vulnerability. The vulnerability can be exploited by an attacker to gain elevated privileges...

Microsoft Windows 数字错误漏洞

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. Microsoft Windows has a security vulnerability. The vulnerability can be exploited by an attacker to gain elevated privileges...

PT-2025-28396 · Sinec Nms · Sinec Nms

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V4.0 Description: A security issue has been identified in the affected application, where it does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary...

PT-2025-28659 · Hewlett Packard · Hpe Networking Instant On Access Points

Name of the Vulnerable Software and Affected Versions: HPE Networking Instant On Access Points affected versions not specified Description: An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points. Successful exploitation cou...

SAP NetWeaver Application Server 安全漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server that stems from a failure to perform required authorization checks on authenticated users, which could result in elevated privileges...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to improper assignment of permissions to the local listening file. An attacker can gain elevated privileges by accessing or modifying the file with insufficiently restricted...

WordPress plugin RealHomes 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin fluXtore 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the fileUploadHandler process. An attacker can write arbitrary files to the filesystem by supplying crafted values to the fc.Name parameter, which is not properly sanitized, allowing directory traversal. This c...