CVE-2025-5466

CVE-2025-5466 is an XML External Entity (XEE) vulnerability affecting Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access. The issue allows a remote authenticated attacker with admin privileges to trigger a denial of service. Affected versions before the stated fixes ...

Security update for eclipse-jgit

This update for eclipse-jgit fixes the following issues: CVE-2025-4949: Fixed the XXE vulnerability in ManifestParser and AmazonS3 class bsc1243647. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...

CVE-2025-40768

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V3.0. The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access the application...

CVE-2025-40768

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V3.0. The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access the application...

CVE-2025-40584

A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 All versions, SIMOTION SCOUT TIA V5.5 All versions, SIMOTION SCOUT TIA V5.6 All versions V5.6 SP1 HF7, SIMOTION SCOUT TIA V5.7 All versions V5.7 SP1 HF1, SIMOTION SCOUT V5.4 All versions, SIMOTION SCOUT V5.5 All versions, SIMOTION SCO...

CVE-2025-40768

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V3.0. The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access the application...

CVE-2025-40768

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V3.0. The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access the application...

CVE-2025-40768

CVE-2025-40768 affects Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) versions prior to 3.0. The vulnerability stems from the application exposing an internal service port that can be accessed from outside the system, potentially allowing an unauthorized attacker to access the application. P...

CVE-2025-40584

A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 All versions, SIMOTION SCOUT TIA V5.5 All versions, SIMOTION SCOUT TIA V5.6 All versions V5.6 SP1 HF7, SIMOTION SCOUT TIA V5.7 All versions V5.7 SP1 HF1, SIMOTION SCOUT V5.4 All versions, SIMOTION SCOUT V5.5 All versions, SIMOTION SCO...

CVE-2025-40584

A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 All versions, SIMOTION SCOUT TIA V5.5 All versions, SIMOTION SCOUT TIA V5.6 All versions V5.6 SP1 HF7, SIMOTION SCOUT TIA V5.7 All versions V5.7 SP1 HF1, SIMOTION SCOUT V5.4 All versions, SIMOTION SCOUT V5.5 All versions, SIMOTION SCO...

CVE-2025-40584

CVE-2025-40584 maps to an XXE (XML External Entity) vulnerability in Siemens products, affecting SIMOTION SCOUT TIA (V5.4–V5.7 with various SP/HF constraints) and SIMOTION SCOUT/V5, as well as SINAMICS STARTER (V5.5–V5.7) across all versions listed. The flaw occurs while parsing crafted XML and c...

Windows Security App Spoofing Vulnerability

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally...

CVE-2025-42941

SAP Fiori Launchpad is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pages. While administrative access is necessary...

CVE-2025-42941 Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad)

SAP Fiori Launchpad is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pages. While administrative access is necessary...

CVE-2025-42941 Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad)

SAP Fiori Launchpad is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pages. While administrative access is necessary...

CVE-2025-42941

The CVE-2025-42941 entry describes a Reverse Tabnabbing issue in SAP Fiori (Launchpad) caused by insufficient external navigation protections on links. Affected software is SAP Fiori (Launchpad); the root cause is lack of proper navigation safeguards for anchor elements. Consequences stated incl...

Use of Web Link to Untrusted Target with window.opener Access

Overview hfs is a HTTP File Server Affected versions of this package are vulnerable to Use of Web Link to Untrusted Target with window.opener Access via the openFileMenu function in the fileMenu.ts file. An attacker can manipulate the content of the original browser tab by exploiting the...

svg-sanitizer 输入验证错误漏洞

svg-sanitizer is a SVG format file cleaning tool by the individual developer Daryll Doyle. An input validation error vulnerability exists in versions of svg-sanitizer prior to 0.22.0, which stems from the cleanXlinkHrefs method searching only for lowercase attribute names, which could lead to...

PT-2025-32663

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to 3.0 Description: The affected application exposes an internal service port accessible from outside the system, potentially allowing unauthorized access. Recommendations: Update SINEC Traffic Analyzer t...

PT-2025-32689 · Unknown · Svg-Sanitizer

Name of the Vulnerable Software and Affected Versions: savg-sanitizer versions prior to 0.22.0 Description: savg-sanitizer is a PHP SVG/XML sanitizer. The sanitization logic in the cleanXlinkHrefs function only searches for lower-case attribute names, bypassing the isHrefSafeValue check. This...