Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the account creation process. An attacker can manipulate the session of a logged-in administrator to create a new account with elevated privileges by tricking the administrator into interacting with a...

PT-2025-7322

Name of the Vulnerable Software and Affected Versions Carrier - Block Load versions 4.00 through 4.16 Description An uncontrolled search path element issue exists, potentially allowing an attacker to perform DLL hijacking and execute arbitrary code with elevated privileges. This issue is reported...

WordPress plugin CarSpot 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin GetBookingsWP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

SUSE CVE-2023-20900

A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a...

CVE-2024-30165

Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions, a different vulnerability than CVE-2024-30164...

Azure Linux 3.0 Security Update: nodejs / nodejs18 (CVE-2024-21892)

The version of nodejs / nodejs18 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-21892 advisory. - On Linux, Node.js ignores certain environment variables if those May have been set by an...

Wazuh 安全漏洞

Wazuh is a Wazuh open source application. It is used to collect, aggregate, index and analyze security data to help organizations detect intrusions, threats and behavioral anomalies. A security vulnerability exists in Wazuh version 4.8.2 that stems from the inclusion of an Access Control Error...

Nothing OS 安全漏洞

Nothing OS is an operating system from Nothing. A security vulnerability exists in Nothing OS version 2.6, which stems from a flaw in the NtBpfService component that could lead to elevated privileges for a local attacker...

Intel多款产品 安全漏洞

Intel Server Board S2600ST and others are products of Intel Corporation Intel, U.S.A. Intel Server Board S2600ST is a series of motherboards.Intel Server Board S2600BP is a server motherboard.Intel Server Board S2600WF is a server motherboard. A security vulnerability exists in a variety of Intel...

Intel Server Board多款产品 访问控制错误漏洞

Intel Server Board S2600ST and others are products of Intel Corporation Intel, U.S.A. Intel Server Board S2600ST is a series of motherboards.Intel Server Board S2600BP is a server motherboard.Intel Server Board S2600WF is Intel Server Board S2600WF is a server motherboard. An Access Control Error...

Vulnerabilities fixed in Microsoft Visual Studio

Microsoft has fixed vulnerabilities in Visual Studio. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges, potentially executing arbitrary code with developer privileges. Successful exploitation requires the malicious party to trick the victim into opening...

Siemens SIMATIC IPC DiagBase 安全漏洞

Siemens SIMATIC IPC DiagBase is a diagnostic software from Siemens, Germany, used to monitor and diagnose the hardware and system status of SIMATIC IPCs industrial computers. A security vulnerability exists in Siemens SIMATIC IPC DiagBase that stems from affected devices not properly restricting...

Adobe Photoshop 安全漏洞

Adobe Photoshop is a suite of image processing software from the American company Audobee Adobe. The software is primarily used for processing images. A security vulnerability exists in Adobe Photoshop that stems from vulnerability to a temporary file creation in a directory with incorrect...

AMD DASH CLI Incorrect Default Permissions Vulnerability

AMD ID: AMD-SB-9008 Potential Impact: Arbitrary Code Execution Severity: High Summary A researcher reported an incorrect default permissions vulnerability within the AMD DASH CLI Software. The AMD Desktop and mobile Architecture for System Hardware DASH Command Line Interface CLI is a command-lin...

Microsoft Windows 后置链接漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A backlink vulnerability exists in Microsoft Windows. An attacker could exploit this vulnerability to gain elevated privileges. The following products and editions are affected:Windows 10...

Microsoft Windows 后置链接漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A backlink vulnerability exists in Microsoft Windows. An attacker could exploit this vulnerability to gain elevated privileges. The following products and versions are affected:Windows...

Cisco Identity Services Engine Code Issue Vulnerability (CNVD-2025-03531)

Cisco Identity Services Engine is an environment-aware platform from the U.S. company Cisco Cisco. The Cisco Identity Services Engine API has a code issue vulnerability that can be exploited by a remote attacker to submit a special request that can execute arbitrary commands with elevated...

CVE-2024-57967

PVWA Password Vault Web Access in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated privileges in LDAP mapping...

CVE-2025-20124

A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. This vulnerability is due to insecure deserialization of user-supplied Java byte streams by the affected software. An attacker could exploit...