LDAP Injection

Mattermost is vulnerable to LDAP Injection. The vulnerability is due to improper validation due to failure to sanitize LDAP group ID attributes in the /api/v4/ldap/groups/remoteid/link API when objectGUID is used as the Group ID Attribute...

CVE-2025-5868

A vulnerability, which was classified as critical, has been found in RT-Thread 5.1.0. This issue affects the function systhreadsigprocmask of the file rt-thread/components/lwp/lwpsyscall.c. The manipulation of the argument how leads to improper validation of array index...

Fortinet Fortigate eap-cert-auth bypass via revoked certificate (FG-IR-24-544)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-544 advisory. - An Improper Certificate Validation vulnerability CWE-295 in FortiOS version 7.6.1 and below, version 7.4.7 and below may...

CVE-2025-5868 RT-Thread lwp_syscall.c sys_thread_sigprocmask array index

A vulnerability, which was classified as critical, has been found in RT-Thread 5.1.0. This issue affects the function systhreadsigprocmask of the file rt-thread/components/lwp/lwpsyscall.c. The manipulation of the argument how leads to improper validation of array index...

CVE-2025-5868

RT-Thread CVE-2025-5868 affects RT-Thread 5.1.0 in the function sys_thread_sigprocmask (rt-thread/components/lwp/lwp_syscall.c). The issue arises from manipulation of the how argument, leading to improper validation of an array index in the lwp_syscall, which is described as a critical vulnerabil...

CVE-2025-5866

CVE-2025-5866 affects RT-Thread 5.1.0, specifically the sys_sigprocmask function in rt-thread/components/lwp/lwp_syscall.c. The issue arises from improper validation of an array index caused by manipulation of the how argument. This is rated critical/high across sources (NVD, Red Hat, CVE lists),...

CVE-2025-5866 RT-Thread lwp_syscall.c sys_sigprocmask array index

A vulnerability classified as critical has been found in RT-Thread 5.1.0. This affects the function syssigprocmask of the file rt-thread/components/lwp/lwpsyscall.c. The manipulation of the argument how leads to improper validation of array index...

PT-2025-24413 · Rt-Thread · Rt-Thread

Name of the Vulnerable Software and Affected Versions: RT-Thread version 5.1.0 Description: A critical issue has been found in the function sys thread sigprocmask of the file rt-thread/components/lwp/lwp syscall.c. The manipulation of the argument how leads to improper validation of array index...

CVE-2025-20278

A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. This vulnerability is due to improper validation of user-supplied...

CVE-2025-49292 WordPress Profile Builder <= 3.13.8 - Content Spoofing Vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder allows Phishing. This issue affects Profile Builder: from n/a through 3.13.8...

FreeScout Cross-Site Scripting Vulnerability (CNVD-2025-20797)

FreeScout is an ultra-lightweight free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout. FreeScout suffers from a cross-site scripting vulnerability that is caused by an arbitrary client profile that improperly validates user-supplied input. No detailed...

Cisco Unified Communications Manager Command Injection (cisco-sa-vos-command-inject-65s2UCYy)

According to its self-reported version, Cisco Unified Communications Manager is affected by a command injection vulnerability. - A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlyin...

Path Traversal

astrbot is vulnerable to a Path Traversal. The vulnerability is due to improper validation or sanitization of file path inputs, allowing attackers to access files outside the intended directories...

Privilege Escalation

org.wso2.am, am-parent, org.wso2.is, identity-server-parent are vulnerable to privilege escalation. The vulnerability is due to improper validation and access control in the SOAP admin services, which allows attackers to assign elevated privileges to self-registered users under specific deploymen...

io.netty:netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

A flaw was found in Netty's SslHandler. This vulnerability allows a native crash via a specially crafted packet that bypasses proper validation...

CVE-2024-12224

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname...

FreeScout 跨站脚本漏洞

FreeScout is an ultra-lightweight free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout. FreeScout suffers from a cross-site scripting vulnerability that is caused by improper validation of user-supplied input during data reception. No detailed vulnerability...

FreeScout 跨站脚本漏洞

FreeScout is an ultra-lightweight free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout. FreeScout suffers from a security bypass vulnerability that is caused by improper validation of user-supplied input in the session POST dataset. No detailed vulnerability...

CVE-2025-3755

This CVE affects Mitsubishi Electric MELSEC iQ-F Series CPU modules (MELSEC iQ-F Series). The root cause is improper validation of a specified index, position, or offset in input, allowing a remote, unauthenticated attacker to read information from the product and to cause a Denial-of-Service (Do...

CVE-2025-3357

IBM Tivoli Monitoring (ITM) 6.3.0.7 through Service Pack 19 is affected by a remote code execution vulnerability caused by improper validation of an index value in a dynamically allocated array. The CVSS base score is 9.8 (Network, no authentication, user interaction not required; code can affect...