18933 matches found
CVE-2025-2072 Reflected Cross-Site Scripting (XSS) Vulnerability in FAST LTA Silent Brick WebUI
A Reflected Cross-Site Scripting XSS vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attackers to inject malicious JavaScript code into web pages viewed by users. This issue arises when user-supplied input is improperly handled and reflected directly in the output of a...
CVE-2025-2072 Reflected Cross-Site Scripting (XSS) Vulnerability in FAST LTA Silent Brick WebUI
A Reflected Cross-Site Scripting XSS vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attackers to inject malicious JavaScript code into web pages viewed by users. This issue arises when user-supplied input is improperly handled and reflected directly in the output of a...
CVE-2025-2072
FAST LTA Silent Brick WebUI is affected by a Reflected Cross-Site Scripting (XSS) vulnerability. The issue occurs when user-supplied input is reflected in output without proper sanitization or encoding, enabling arbitrary JavaScript execution in the victim’s browser. Affected WebUI parameters inc...
Beego 跨站脚本漏洞
Beego is an open source web framework based on the Go language from Beego Open Source. A cross-site scripting vulnerability exists in Beego versions prior to 2.3.6, which stems from a cross-site scripting attack in the RenderForm function that could lead to session hijacking, credential theft, or...
CVE-2025-2859
An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user...
CVE-2025-2516
The use of a weak cryptographic key pair in the signature verification process in WPS Office Kingsoft on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the update server's certificate, an...
CVE-2025-30407
Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 39713...
CVE-2025-2098
Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions rwxrwxrwx. This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users...
Duplicate Advisory: HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f7jh-m6wp-jm7f. This link is maintained to preserve external references. Original Description A flaw was found in the JBoss EAP Management Console, where a stored Cross-site scripting vulnerability occurs when a...
CVE-2025-2901
Rejected reason: This vulnerability is redundant to CVE-2025-23366 and CVE-2024-10234...
CVE-2025-2901
CVE-2025-2901 is rejected/not used and does not represent an active vulnerability entry.
CVE-2025-2859
CVE-2025-2859 corresponds to an authorization-related flaw in Arteche saTECH BCU (notably version 2.1.3 per CNNVD/CVE records) that allows an attacker with network access to capture traffic, steal user cookies and active sessions, and potentially modify device behavior via the web interface. The ...
PT-2025-13517 · Arteche · Satech Bcu
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An attacker with access to the network where the vulnerable device is located could capture traffic and obtain cookies from the user, allowing them to steal a user's active session and make...
PT-2025-13530 · Red Hat · Jboss Eap Management Console
Name of the Vulnerable Software and Affected Versions: JBoss EAP Management Console affected versions not specified Description: A stored Cross-site scripting issue occurs when the application fails to properly sanitize user input before storing it, allowing malicious scripts to execute in the...
CVE-2025-2516
The use of a weak cryptographic key pair in the signature verification process in WPS Office Kingsoft on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the update server's certificate, an...
CVE-2025-2516
CVE-2025-2516 affects Kingsoft WPS Office on Windows, where signature verification uses a weak cryptographic key pair. If the private key is recovered, an attacker could sign components. The issue is compounded by older WPS Office versions not validating the update server certificate, enabling a ...
Hiro: Logout Bypass Vulnerability in Hiro.so
Summary A logout bypass vulnerability has been identified on platform.hiro.so, allowing users to regain access to their session after logging out simply by pressing the back button on the browser. This issue arises due to improper session invalidation and potential caching misconfigurations. If...
150,000 Sites Compromised by JavaScript Injection Promoting Chinese Gambling Platforms
An ongoing campaign that infiltrates legitimate websites with malicious JavaScript injects to promote Chinese-language gambling platforms has ballooned to compromise approximately 150,000 sites to date. "The threat actor has slightly revamped their interface but is still relying on an iframe...
