CVE-2025-8267

Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery SSRF due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 Multicast as invalid. This oversight allows attackers to craf...

PT-2025-31048

Name of the Vulnerable Software and Affected Versions ssrfcheck versions prior to 1.2.0 Description The package is vulnerable to Server-Side Request Forgery SSRF due to an incomplete denylist of IP address ranges. The package fails to classify the reserved IP address space 224.0.0.0/4 Multicast a...

FreeBSD : Mozilla -- CORS circumvention (58027367-685e-11f0-a12d-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 58027367-685e-11f0-a12d-b42e991fc52e advisory. [email protected] reports: Thunderbird cached CORS preflight responses across IP address changes. Th...

CVE-2025-8020

All versions of the package private-ip are vulnerable to Server-Side Request Forgery SSRF where an attacker can provide an IP or hostname that resolves to a multicast IP address 224.0.0.0/4 which is not included as part of the private IP ranges in the package's source code...

The vulnerability of the cckeckKeepAlive() function in the microprogramming software of the TOTOLink T6 system allows a hacker to execute arbitrary commands.

The vulnerability of the cckeckKeepAlive function in the TOTOLink T6 mesh-system’s software lies in the lack of measures taken to neutralize special elements during the processing of the ipAddr parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

SUSE CVE-2025-8036

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

CVE-2025-8020

All versions of the package private-ip are vulnerable to Server-Side Request Forgery SSRF where an attacker can provide an IP or hostname that resolves to a multicast IP address 224.0.0.0/4 which is not included as part of the private IP ranges in the package's source code...

CVE-2025-8020

CVE-2025-8020 affects the private-ip package. All versions are reported vulnerable to Server-Side Request Forgery (SSRF) by accepting an IP/hostname that resolves to a multicast address (224.0.0.0/4), which is not excluded by the package’s private IP range checks. Multiple sources (RH, NVD, GitHu...

CVE-2025-8036

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

CVE-2025-8036

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

UBUNTU-CVE-2025-8036

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

Mozilla Firefox ESR < 140.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-59 advisory. - Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140...

Mozilla Firefox ESR < 140.1

The version of Firefox ESR installed on the remote Windows host is prior to 140.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-59 advisory. - Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of...

CVE-2025-3621

Vulnerabilities in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. vulnerabilities: Improper Neutralization of Special Elements used in a Command 'Command Injection' Use of Hard-coded Credentials Improper Authentication Binding to an...

CVE-2025-3621

Vulnerabilities in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. vulnerabilities: Improper Neutralization of Special Elements used in a Command 'Command Injection' Use of Hard-coded Credentials Improper Authentication Binding to an...

CVE-2025-3621 Remote Code Execution in ProTNS ActADUR

Vulnerabilities in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. vulnerabilities: Improper Neutralization of Special Elements used in a Command 'Command Injection' Use of Hard-coded Credentials Improper Authentication Binding to an...

CVE-2025-3621

CVE-2025-3621 affects ProTNS ActADUR local server. Multiple vulnerabilities in ActADUR (v2.0.1.9 and earlier) enable remote code execution via remote command injection, with issues including hard-coded credentials, improper authentication, and binding to an unrestricted IP. Exploitation vectors a...

PT-2025-29540 · Protns · Actadur

Name of the Vulnerable Software and Affected Versions: ActADUR versions 2.0.1.9 through 2.0.1.9 Description: The ActADUR local server product, developed and maintained by ProTNS, allows for Remote Code Inclusion on host systems. The vulnerability has been rated as critical and includes issues suc...

cloud-init: Cloud init permissions flaw

An access permissions flaw was found in cloud-init. When a non-x86 platform is detected, cloud-init grants root access to a hardcoded URL with a local IP address, which creates a security exposure...

VulnCheck KEV: CVE-2024-51977

An unauthenticated attacker who can access either the HTTP service TCP port 80, the HTTPS service TCP port 443, or the IPP service TCP port 631, can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mntinfo.csv can be accessed via a GET request and no...