Use of Web Link to Untrusted Target with window.opener Access

Overview hfs is a HTTP File Server Affected versions of this package are vulnerable to Use of Web Link to Untrusted Target with window.opener Access via the openFileMenu function in the fileMenu.ts file. An attacker can manipulate the content of the original browser tab by exploiting the...

svg-sanitizer 输入验证错误漏洞

svg-sanitizer is a SVG format file cleaning tool by the individual developer Daryll Doyle. An input validation error vulnerability exists in versions of svg-sanitizer prior to 0.22.0, which stems from the cleanXlinkHrefs method searching only for lowercase attribute names, which could lead to...

PT-2025-32663

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to 3.0 Description: The affected application exposes an internal service port accessible from outside the system, potentially allowing unauthorized access. Recommendations: Update SINEC Traffic Analyzer t...

PT-2025-32689 · Unknown · Svg-Sanitizer

Name of the Vulnerable Software and Affected Versions: savg-sanitizer versions prior to 0.22.0 Description: savg-sanitizer is a PHP SVG/XML sanitizer. The sanitization logic in the cleanXlinkHrefs function only searches for lower-case attribute names, bypassing the isHrefSafeValue check. This...

Siemens多款产品 代码问题漏洞

Siemens SIMOTION SCOUT TIA and others are products of Siemens, Germany.Siemens SIMOTION SCOUT TIA is a high-end motion control system.Siemens SIMOTION SCOUT is a high-end motion control system.Siemens SINAMICS STARTER is a drive debugging tool software. A code issue vulnerability exists in severa...

PT-2025-32851 · Microsoft · Windows Security App

Name of the Vulnerable Software and Affected Versions: Windows Security App affected versions not specified Description: The Windows Security App contains a flaw related to external control of file names or paths. This allows an authorized attacker to perform local spoofing. Recommendations: At t...

Ivanti多款产品 安全漏洞

Ivanti Connect Secure ICS, among others, are products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure IPS is a network access control NAC solution.Ivanti Neurons Ivanti Neurons for Secure is a secure cloud technology platform. A...

Linux Distros Unpatched Vulnerability : CVE-2024-46709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix prime with external buffers Make sure that for external buffers mapping goes...

PT-2025-32679 · Ivanti · Ivanti Connect Secure +3

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.8 and 22.8R2 Ivanti Policy Secure versions prior to 22.7R1.5 Ivanti ZTA Gateway versions prior to 22.8R2.3-723 Ivanti Neurons for Secure Access versions prior to 22.8R1.4 Description: An XML...

Siemens SIMOTION SCOUT, SIMOTION SCOUT TIA, and SINAMICS STARTER

SUMMARY SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER are affected by an XXE injection vulnerability that could allow an attacker to access arbitrary application files. Siemens has released new versions for several affected products and recommends to update to the latest versions...

SAP Fiori 安全漏洞

SAP Fiori, a user experience UX design system for SAP applications from SAP, Germany, provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, delivering a consistent, innovative experience for creators and users. A security...

VulnCheck KEV: CVE-2025-54254

Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local file system, scope i...

PT-2025-32651 · Siemens · Sinamics Starter +2

Name of the Vulnerable Software and Affected Versions: SIMOTION SCOUT TIA versions 5.4, 5.5, 5.6 through 5.6 SP1 HF6, and 5.7 through 5.7 SP1 HF0 SIMOTION SCOUT versions 5.4, 5.5, 5.6 through 5.6 SP1 HF6, and 5.7 through 5.7 SP1 HF0 SINAMICS STARTER versions 5.5, 5.6, and 5.7 Description: The...

Stable Channel Update for Desktop

The Stable channel has been updated to 139.0.7258.127/.128 for Windows, Mac and 139.0.7258.127 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and links may be kept...

AMD Graphics Vulnerabilities – August 2025

Summary Audits performed on AMD graphics and datacenter accelerator products, as well as external reports received by AMD, uncovered potential vulnerabilities affecting AMD graphics, datacenter, and some client processors...

CVE-2025-54992

OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity XXE injection vulnerability was found in OpenKilda which in combination with GHSL-2025-024 allows unauthenticated attackers to exfiltrate information from the instance where the OpenKilda UI is...

CVE-2025-54992

CVE-2025-54992 affects OpenKilda (OpenFlow controller). Multiple connected sources describe an XML external entity (XXE) injection vulnerability, specifically in the SAML/XML handling, that could allow unauthenticated attackers to exfiltrate information from the OpenKilda UI instance, leading to ...

CVE-2025-54992 OpenKilda XXE in SAML configuration

OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity XXE injection vulnerability was found in OpenKilda which in combination with GHSL-2025-024 allows unauthenticated attackers to exfiltrate information from the instance where the OpenKilda UI is...

CVE-2025-54992 OpenKilda XXE in SAML configuration

OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity XXE injection vulnerability was found in OpenKilda which in combination with GHSL-2025-024 allows unauthenticated attackers to exfiltrate information from the instance where the OpenKilda UI is...

Cross-site Scripting (XSS)

github.com/usememos/memos is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unrestricted external image embedding because markdown images with arbitrary URLs are automatically fetched when viewing a memo, exposing the user's IP address, browser User-Agent, and other...