1504 matches found
PT-2025-44783
Name of the Vulnerable Software and Affected Versions iceScrum versions 7.54 Pro On-prem Description A remote code execution RCE issue exists in the Postgres Drivers component of iceScrum. An attacker can execute arbitrary code by using a specially crafted HTML page. Recommendations At the moment...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a misinterpretation of Input in golang.org/x/net/proxy [CVE-2025-22870]
Summary IBM Watson Speech Services Cartridge is vulnerable to a misinterpretation of Input in golang.org/x/net/proxy, due to matching of hosts against proxy patterns which can improperly treat an IPv6 zone ID as a hostname component CVE-2025-22870. Golang is used in our speech utilities. This...
PT-2025-44596
Name of the Vulnerable Software and Affected Versions Therefore Online affected versions not specified Therefore On-Premises affected versions not specified Description A malicious user may be able to impersonate the web service account or the account of a service using the API when connecting to...
PT-2025-44645
Name of the Vulnerable Software and Affected Versions Bizerba Communication Server BCS affected versions not specified Description The Bizerba Communication Server BCS service has an unquoted service path. This occurs when the Windows service's executable path contains spaces but is not enclosed ...
PT-2025-44192
Name of the Vulnerable Software and Affected Versions Reolink Video Doorbell Wi-Fi DB 566128M5MP W affected versions not specified Description The Reolink Video Doorbell Wi-Fi DB 566128M5MP W stores and transmits Dynamic DNS DDNS credentials in plaintext within its configuration and update script...
PT-2025-44102
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the PCI/AER subsystem. Specifically, a NULL pointer dereference can occur in the aer ratelimit function when processing error information supplied...
PT-2025-44062
Name of the Vulnerable Software and Affected Versions affected versions not specified Description A GUI dialog within an application permits unauthorized viewing of files present in the file system. This occurs due to a lack of appropriate authorization checks when displaying file system contents...
PT-2025-43959
Name of the Vulnerable Software and Affected Versions StarCharge Artemis AC Charger version 1.0.4 Description The StarCharge Artemis AC Charger version 1.0.4 contains a hardcoded AES key. This allows attackers to forge or decrypt valid login tokens. Recommendations At the moment, there is no...
PT-2025-43924
Name of the Vulnerable Software and Affected Versions versions prior to 2025 Description The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access, increasing the risk of unauthorised connections...
PT-2025-43609
Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description The Try-It feature, accessible to administrative users, contains server-side request forgery SSRF and reflected cross-site scripting XSS issues. The feature does not properly validate...
PT-2025-45464
Name of the Vulnerable Software and Affected Versions Google Chrome affected versions not specified Description A flaw exists in the Google Chrome Omnibox component related to improper control flow management. Successful exploitation could allow a remote attacker to disclose sensitive information...
PT-2025-43446
Name of the Vulnerable Software and Affected Versions affected versions not specified Description A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts. Recommendations At the...
CVE-2025-11570
Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting XSS due to insufficient filtering of data. Note: This is exploitable only if the code is executed outside of Drupal; the function is intended to be shared between Drupal and Patter...
CVE-2025-61925
Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in X-Forwarded-Host in output when using Astro.url without any validation. It is common for web servers such as nginx to route requests via the Host header, and forward on other request headers. As such as malicious reque...
EUVD-2025-33756
HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. This enables HTTP response splitting and header...
PT-2025-44676
Name of the Vulnerable Software and Affected Versions Chromium affected versions not specified Description An issue exists in Google Chrome due to an inappropriate implementation in V8, potentially allowing attackers to affect the system. Microsoft Edge Chromium-based is also impacted as it inges...
PT-2025-41349
Name of the Vulnerable Software and Affected Versions Versions prior to 2025-47342 Description A temporary denial-of-service condition might happen when multiple profiles are used at the same time with QHS enabled. Recommendations At the moment, there is no information about a newer version that...
EUVD-2021-0422
Malware in sbrugna...