CVE-2025-1488 WPO365 | MICROSOFT 365 GRAPH MAILER <= 3.2 - Open Redirect via 'redirect_to' Parameter

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insufficient validation on the redirect url supplied via the 'redirectto' parameter. This makes it possible for unauthenticated attackers to redire...

CVE-2024-13888

The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially...

Cisco Video Phone 8875 and Desk Phone 9800 Series Information Disclosure (cisco-sa-phone-info-disc-YyxsWStK)

According to its self-reported version, Cisco Video Phone 8875 and Desk Phone 9800 Series Information Disclosure is affected by a vulnerability. - A vulnerability in the debug shell of Cisco Video Phone 8875 and Cisco Desk Phone 9800 Series could allow an authenticated, local attacker to access...

CVE-2024-13888 WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter

The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially...

The vulnerability of the Microsoft Dynamics 365 Sales resource planning software server lies in insufficient validation of requests on the server side, allowing attackers to increase their privileges.

The vulnerability of the Microsoft Dynamics 365 Sales resource planning software server relates to insufficient validation of requests on the server side. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

CVE-2024-13879

The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the webhook feature. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

RockyLinux 8 : redis:6 (RLSA-2025:0595)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:0595 advisory. redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service CVE-2023-22458 redis: Integer overflow in the Redi...

CVE-2025-24868

The User Account and Authentication service UAA for SAP HANA extended application services, advanced model SAP HANA XS advanced model allows an unauthenticated attacker to craft a malicious link, that, when clicked by a victim, redirects the browser to a malicious site due to insufficient redirec...

ROS-20250212-13

Vulnerability in the ntpd daemon implementation of the NTP time synchronization protocol is related to insufficient validation of user input during NTP packet processing. user input during NTP packet processing. Exploitation of the vulnerability could allow an attacker acting remotely to cause a...

Mercedes-Benz NTG 安全漏洞

Mercedes-Benz NTG is an automobile from Mercedes-Benz Germany. A security vulnerability exists in Mercedes-Benz NTG 6 that stems from insufficient file checking when importing or exporting profile settings via USB. An attacker could exploit the vulnerability to write arbitrary files...

PT-2025-28676 · Irfanview · Irfanview +1

Name of the Vulnerable Software and Affected Versions: IrfanView CADImage Plugin versions affected versions not specified Description: This issue involves a memory corruption flaw in the DWG file parsing component of the IrfanView CADImage Plugin. Exploitation of this flaw could allow a remote...

Huawei EulerOS: Security Advisory for subversion (EulerOS-SA-2025-1198)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for subversion (EulerOS-SA-2025-1167)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for subversion (EulerOS-SA-2025-1148)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-20205

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied...

CVE-2025-20180

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is...

Arbitrary Code Execution

ckan is vulnerable to Arbitrary Code Execution. The vulnerability is due to insufficient validation of uploaded files, allowing a specially crafted file to execute code when opened by an administrator, potentially leading to privilege escalation or other malicious actions...

CVE-2025-22880

CVE-2025-22880 affects Delta Electronics CNCSoft-G2. The issue is a heap-based buffer overflow caused by inadequate validation of the length of user-supplied data before copying to a fixed-length heap buffer. This can allow code execution in the context of the current process when a target visits...

Janto Ticketing 数据伪造问题漏洞

Janto Ticketing is a ticketing software from Janto. A data forgery issue vulnerability exists in versions of Janto Ticketing prior to r12, which stems from insufficient data authenticity validation and allows an unauthorized user to change a password to reset the content of an email...

CVE-2021-4330

The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes it possible for...