CVE-2025-61734 Apache Kylin: improper restriction of file read

Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the...

Configure Proper Policies for INPUT of iptables

The INPUT chain is used to filter packets received from external systems. For any service provided for external systems, configure the corresponding INPUT policy and enable the related port so that external clients can access the service through the port. If the policy is not set, all packets tha...

CVE-2025-34202

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 VA and SaaS deployments expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker able to add routes using the appliance as a...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in Azure components. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges, or execute arbitrary code. The most serious vulnerability is in the High-Performance Compute Pack HPC and allows an unauthenticated malicious pers...

Linux Distros Unpatched Vulnerability : CVE-2024-43430

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in moodle. External API access to Quiz can override contained insufficient access control. CVE-2024-43430 Note that Nessus relies on the presen...

CVE-2025-52460

Files or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier Media version:16.0.0a and earlier. If exploited, uploaded files and SS1 configuration files may be accessed by a remote unauthenticated attacker...

Linux Distros Unpatched Vulnerability : CVE-2021-39935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all version...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties files uploaded by object entry and stored in documentlibrary, via URL. Remediation Upgrade com.liferay:com.liferay.object.web to version 1.0.219 or higher. References - GitHub Commit -...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties files uploaded by object entry and stored in documentlibrary, via URL. Remediation Upgrade com.liferay:com.liferay.frontend.js.web to version 5.0.125 or higher. References - GitHub...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties files uploaded by object entry and stored in documentlibrary, via URL. Remediation Upgrade com.liferay:com.liferay.object.dynamic.data.mapping.form.field.type to version 1.0.65 or...

CVE-2025-27217

The CVE-2025-27217 entry concerns a Server-Side Request Forgery (SSRF) in the UISP Application. Affected software: UISP Application. Vulnerability: SSRF allowing a user with certain permissions to make requests outside the UISP scope. Root cause: SSF vulnerability within the UISP Application; imp...

CVE-2025-8415 Cryostat: authentication bypass if network policies are disabled

A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment...

CVE-2025-40768

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V3.0. The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access the application...

CVE-2025-40768

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V3.0. The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access the application...

CVE-2025-40768

CVE-2025-40768 affects Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) versions prior to 3.0. The vulnerability stems from the application exposing an internal service port that can be accessed from outside the system, potentially allowing an unauthorized attacker to access the application. P...

CVE-2025-40768

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V3.0. The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access the application...

CVE-2025-40768

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V3.0. The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access the application...

PT-2025-32663

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to 3.0 Description: The affected application exposes an internal service port accessible from outside the system, potentially allowing unauthorized access. Recommendations: Update SINEC Traffic Analyzer t...

PT-2025-117: Server‑Side Request Forgery (SSRF) in FreeScout

The vulnerability was identified in FreeScout , versions 1.8.182. The discovered vulnerability allows an attacker to make requests to both local and external resources, mask their own IP address and retrieve data from protected network segments. Vulnerability status: Confirmed by vendor Date of...

CVE-2025-8516 Kingdee Cloud-Starry-Sky Enterprise Edition IIS-K3CloudMiniApp FileUploadAction.class path traversal

A security vulnerability has been detected in Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. This issue affects the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file...