CVE-2025-3268 qinguoyi TinyWebServer http_conn.cpp improper authentication

A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/httpconn.cpp. The manipulation of the argument murlreal leads to improper authentication. The attack can be initiated remotely. The exploit has...

TinyWebServer 授权问题漏洞

TinyWebServer is a C++ lightweight WebServer server for Linux by qinguoyi Personal Developer. An authorization issue vulnerability exists in TinyWebServer 1.0 and earlier versions, which stems from improper authentication...

PT-2025-15044 · Qinguoyi · Qinguoyi Tinywebserver

Name of the Vulnerable Software and Affected Versions: qinguoyi TinyWebServer version 1.0 Description: A vulnerability has been found in qinguoyi TinyWebServer, classified as critical. This issue affects unknown code of the file http/http conn.cpp. The manipulation of the argument m url real lead...

CVE-2025-3085

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to...

CVE-2025-3085

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to...

CVE-2025-3085

Issue summary. MongoDB Server on Linux with TLS and CRL revocation check enabled may fail to validate revocation status of intermediate certificates in the peer’s certificate chain, potentially allowing improper authentication. This affects MongoDB Server versions: 5.0.x before 5.0.31, 6.0.x befo...

CVE-2025-3085 MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to...

CVE-2025-3085 MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to...

MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to...

The vulnerability of the Microsoft Dataverse data management platform, related to incorrect authorization, allows a perpetrator to escalate their privileges.

The vulnerability of the Microsoft Dataverse data management platform is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

Security Bulletin: IBM Maximo Application Suite Ai-Broker Component vulnerable to BCryptPasswordEncoder will incorrectly return true for passwords larger than 72 characters.

Summary Security Bulletin: IBM Maximo Application Suite Ai-Broker Component vulnerable to BCryptPasswordEncoder will incorrectly return true for passwords larger than 72 characters. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details...

CVE-2025-2859 Improper Authentication vulnerability in saTECH BCU

An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user...

CVE-2025-2859 Improper Authentication vulnerability in saTECH BCU

An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user...

CVE-2025-2859

CVE-2025-2859 corresponds to an authorization-related flaw in Arteche saTECH BCU (notably version 2.1.3 per CNNVD/CVE records) that allows an attacker with network access to capture traffic, steal user cookies and active sessions, and potentially modify device behavior via the web interface. The ...

Xiaomi phone framework 访问控制错误漏洞

The Xiaomi phone framework is an operating system infrastructure from China's Xiaomi Xiaomi that provides a set of system services and interfaces to support the operation of various features and applications on a cell phone. A security vulnerability exists in the Xiaomi phone framework that stems...

Xiaomi phone framework 访问控制错误漏洞

The Xiaomi phone framework is an operating system infrastructure from China's Xiaomi Xiaomi that provides a set of system services and interfaces to support the operation of various features and applications on a cell phone. A security vulnerability exists in the Xiaomi phone framework that stems...

CVE-2024-45481 Improper authentication in SSH of B&R APROL

An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL 4.4-00P5 may allow an authenticated local attacker to authenticate as another legitimate user...

CVE-2024-45481 Improper authentication in SSH of B&R APROL

An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL 4.4-00P5 may allow an authenticated local attacker to authenticate as another legitimate user...

Schneider Electric EcoStruxure Power Automation System User Interface Authorization Issue Vulnerability

Schneider Electric EcoStruxure Power Automation System User Interface is a Schneider Electric user interface software for power automation systems from Schneider Electric France. It is used for operators to interact with the power automation system to improve operational efficiency. The Schneider...

CVE-2024-12869

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed...