PT-2025-38160

Name of the Vulnerable Software and Affected Versions: Apache::AuthAny::Cookie versions 0.201 and earlier Description: The software generates session IDs insecurely using an MD5 hash of the epoch time and the rand function. The epoch time may be guessable if not concealed by the HTTP Date header,...

The vulnerability of the open-source DHCP server Kea, related to an unreliable search process, allows attackers to elevate privileges within the system.

The vulnerability of the open-source DHCP server Kea is related to the use of an insecure lookup path. Exploiting this vulnerability can allow a attacker to gain increased privileges within the system...

MetaCPAN Apache::AuthAny::Cookie 安全漏洞

MetaCPAN Apache::AuthAny::Cookie is a Perl authentication module from the MetaCPAN Foundation. A security vulnerability exists in MetaCPAN Apache::AuthAny::Cookie version 0.201 and earlier, which stems from the use of MD5 hash and rand functions to generate insecure session IDs, which could lead ...

Dragonfly 安全漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly versions prior to 2.1.0 that stems from the use of insecure hash functions such as MD5, which could lead to malicious file replacement...

CVE-2025-57625

CYRISMA Sensor before 444 for Windows has an Insecure Folder and File Permissions vulnerability. A low-privileged user can abuse these issues to escalate privileges and execute arbitrary code in the context of NT AUTHORITY\SYSTEM by replacing DataSpotliteAgent.exe or any other binaries called by...

CVE-2025-59050 Greenshot — Insecure .NET deserialization via WM_COPYDATA enables local code execution

Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WMCOPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local process at the same integrity level to trigge...

Creation of Temporary File With Insecure Permissions

Overview Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions due to data written to RUN --mount=type=bind mounts during the podman build not being discarded. An attacker can gain unauthorized access to sensitive files by exploiting the exposure...

CVE-2025-7355 IDOR in Beefull Energy Technologies' Beefull App

Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This issue affects Beefull App: before 24.07.2025...

CVE-2025-55111

CVE-2025-55111 affects BMC Control-M/Agent; out-of-support versions 9.0.18–9.0.20 and some earlier/upgraded newer versions contain files with overly permissive permissions that store SSL keys, keystores, and policy passwords. An attacker with local access can read these files. The connected sourc...

CVE-2025-55111 BMC Control-M/Agent insecure default file permissions

Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating ...

CVE-2025-55111 BMC Control-M/Agent insecure default file permissions

Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating ...

Insecure Deserialization

picklescan is vulnerable to Insecure Deserialization. The vulnerability is due to the use of torch.utils.collectenv.run function to execute remote pickle files, which allows an attacker to execute arbitrary code...

CYRISMA Sensor 安全漏洞

CYRISMA Sensor is a scanning and detection component from CYRISMA USA. A security vulnerability exists in versions prior to CYRISMA Sensor 444, which stems from insecure folder and file permissions that could allow a low-privileged user to elevate privileges by replacing binaries and executing...

GitHub's Copilot Code Review: Can AI Spot Security Flaws Before You Commit?

As software development practices increasingly adopt AI-powered tools, ensuring that such tools can support secure coding has become critical. This study evaluates the effectiveness of GitHub Copilot's recently introduced code review feature in detecting security vulnerabilities. Using a curated...

CVE-2025-57625

CYRISMA Sensor for Windows versions before 444 contains an insecure folder and file permissions flaw that lets a low-privilege user replace DataSpotliteAgent.exe (or other binaries invoked by the Cyrisma_Agent service at startup) and escalate to NT AUTHORITY\SYSTEM, enabling arbitrary code execut...

CVE-2025-57625

CYRISMA Sensor before 444 for Windows has an Insecure Folder and File Permissions vulnerability. A low-privileged user can abuse these issues to escalate privileges and execute arbitrary code in the context of NT AUTHORITY\SYSTEM by replacing DataSpotliteAgent.exe or any other binaries called by...

PT-2025-38068

Name of the Vulnerable Software and Affected Versions: CYRISMA Sensor versions prior to 444 Description: CYRISMA Sensor before version 444 for Windows contains an Insecure Folder and File Permissions vulnerability. A low-privileged user can exploit this issue to escalate privileges and execute...

CVE-2025-57625

CYRISMA Sensor before 444 for Windows has an Insecure Folder and File Permissions vulnerability. A low-privileged user can abuse these issues to escalate privileges and execute arbitrary code in the context of NT AUTHORITY\SYSTEM by replacing DataSpotliteAgent.exe or any other binaries called by...

PT-2025-38083

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS affected versions not specified Description: A flaw exists in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration ZCS that allows an attacker with valid user credentials to bypass Two-Factor...

CVE-2025-59328

A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service DoS. The issue stems from the insecure deserialization of untrusted data. An attacker can supply a large, specially crafted data payload that, when processed, consumes an excessive amount of CPU resources during...