CVE-2023-7325

Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery SSRF vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix...

CVE-2025-46363

Dell Secure Connect Gateway SCG 5.0 Application and Appliance versions 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal vulnerability in the SCG exposed for an internal collection download REST API if this REST API is enabled by Admin user from UI. A low privileged attacker with remote...

CVE-2025-43027

A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this...

Server-Side Request Forgery (SSRF)

Dragonfly is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of user-supplied URLs in the Manager API and peer communication, which allows an attacker to force internal components to send requests to arbitrary or internal services, potentially...

CVE-2025-58152

FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. With some crafted HTTP request, they can be accessed without authentication...

CVE-2025-58152

FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. With some crafted HTTP request, they can be accessed without authentication...

CVE-2025-58152

The CVE-2025-58152 entry concerns Century Systems FutureNet MA and IP-K series devices. According to connected sources, the vulnerability involves exposing firmware version and garbage collection information on an internal web page, which can be accessed via crafted HTTP requests without authenti...

EUVD-2025-37302

FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. With some crafted HTTP request, they can be accessed without authentication...

Malicious code in @qwant-internal/datahub-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71173ddf94db9194dbde8c27f8d6abad60f54b610533b5d69c1a89d2c002d391 The package @qwant-internal/datahub-logger was found to contain malicious code...

MAL-2025-49279 Malicious code in @qwant-internal/datahub-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71173ddf94db9194dbde8c27f8d6abad60f54b610533b5d69c1a89d2c002d391 The package @qwant-internal/datahub-logger was found to contain malicious code...

EUVD-2025-37234

A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an attacker with access to the UniFi Talk management network to invoke internal debug operations through the device API. Affected Products:...

CVE-2025-52663

A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an attacker with access to the UniFi Talk management network to invoke internal debug operations through the device API. Affected Products:...

Century Systems FutureNet MA-X series 安全漏洞

Century Systems FutureNet MA-X series is a series of industrial communication module devices from Century Systems, Japan. A security vulnerability exists in the Century Systems FutureNet MA-X series that originates from an internal web page that exposes firmware version and garbage collection...

Ubiquiti多款产品 安全漏洞

Ubiquiti UniFi Talk Touch, among others, is an IP phone from Ubiquiti USA. A security vulnerability exists in various Ubiquiti products, which stems from an unintentional enablement of the internal debugging feature, which could allow an attacker to invoke internal debugging operations via the...

CVE-2025-52663

A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an attacker with access to the UniFi Talk management network to invoke internal debug operations through the device API. Affected Products:...

CVE-2025-52663

Affects UniFi Talk devices: UniFi Talk Touch <= 1.21.16, UniFi Talk Touch Max <= 2.21.22, and UniFi Talk G3 Phones = 1.21.17, UniFi Talk Touch Max >= 2.21.23, and UniFi Talk G3 Phones >= 3.21.27. If newer advisories exist, follow their guidance; otherwise these are the stated fixes.

CVE-2025-54546

On affected platforms, restricted users could use SSH port forwarding to access host-internal services...

CVE-2025-34277

CVE-2025-34277 affects Nagios Log Server versions prior to 2024R1.3.1, where a code injection vulnerability arises from inadequate validation of dashboard ID values forwarded to an internal API. An attacker able to supply crafted dashboard ID values can cause the system to execute attacker-contro...

CVE-2023-7325

CVE-2023-7325 affects Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10. The vulnerability is a server-side request forgery (SSRF) in the xmlrpc.sock handler that accepts crafted XML-RPC requests to reach internal unix socket RPC endpoints and execute privileg...

CVE-2023-7325 Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF

Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery SSRF vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix...