MikroTik RouterOS <= 7.19.3 Access Control Vulnerability

MikroTik RouterOS is prone to an access control vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:mikrotik:routeros"...

TOTOLINK T6 Buffer Overflow Vulnerability

TOTOLINK T6 is a wireless dual-band router from China's TOTOLINK Electronics TOTOLINK that supports MQTT protocol and Telnet service. The TOTOLINK T6 suffers from a buffer overflow vulnerability, which originates from the parameter ip in the file /cgi-bin/cstecgi.cgi that fails to correctly...

The vulnerability of the cckeckKeepAlive() function in the microprogramming software of the TOTOLink T6 system allows a hacker to execute arbitrary commands.

The vulnerability of the cckeckKeepAlive function in the TOTOLink T6 mesh-system’s software lies in the lack of measures taken to neutralize special elements during the processing of the ipAddr parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

SUSE CVE-2025-8036

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

private-ip vulnerable to Server-Side Request Forgery

All versions of the package private-ip are vulnerable to Server-Side Request Forgery SSRF, where an attacker can provide an IP or hostname that resolves to a multicast IP address 224.0.0.0/4 which is not included as part of the private IP ranges in the package's source code...

@0xvaibhav/divergent-node (>=0.0.1, <=0.0.3), @0xvaibhav/ipfs-messenger (>=1.0.3, <=1.0.9) +402 more potentially affected by CVE-2025-8020 via private-ip (3.0.2)

private-ip NPM version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on private-ip and may be impacted: - @0xvaibhav/divergent-node =0.0.1, =1.0.3, =0.0.1, =0.0.2, =9.3.0, =1.0.0, =1.3.2, =1.0.1, =1.0.1, =1.1.0, =1.0.2, =1.0.3 -...

CVE-2025-8020

All versions of the package private-ip are vulnerable to Server-Side Request Forgery SSRF where an attacker can provide an IP or hostname that resolves to a multicast IP address 224.0.0.0/4 which is not included as part of the private IP ranges in the package's source code...

CVE-2025-8020

CVE-2025-8020 affects the private-ip package. All versions are reported vulnerable to Server-Side Request Forgery (SSRF) by accepting an IP/hostname that resolves to a multicast address (224.0.0.0/4), which is not excluded by the package’s private IP range checks. Multiple sources (RH, NVD, GitHu...

CVE-2025-8020

All versions of the package private-ip are vulnerable to Server-Side Request Forgery SSRF where an attacker can provide an IP or hostname that resolves to a multicast IP address 224.0.0.0/4 which is not included as part of the private IP ranges in the package's source code...

CVE-2025-8020

All versions of the package private-ip are vulnerable to Server-Side Request Forgery SSRF where an attacker can provide an IP or hostname that resolves to a multicast IP address 224.0.0.0/4 which is not included as part of the private IP ranges in the package's source code...

PT-2025-30612 · Undefined · Undefined

💥 UPDATE We now have a reliable vulnerable detection method check-based for CVE-2025-35770. 📌 Nearly 500 unique IP addresses are vulnerable, counting numerous governmental organizations. SharePoint ToolShell https://t.co/Rle2igcE3X...

private-ip 安全漏洞

private-ip is a tool by Damir Mustafin, a personal developer, to check if an IP address is private. A security vulnerability exists in private-ip that stems from allowing an attacker to provide an IP or hostname that resolves to a multicast IP address, potentially leading to server-side request...

The vulnerability of the fromSetIpBind() function in the /goform/SetIpBind library of the Tenda FH451 router software allows a attacker to execute arbitrary code or cause a service failure.

The vulnerability of the fromSetIpBind function in the /goform/SetIpBind microprogramming system for Tenda FH451 routers is related to buffer overflows when processing the page parameter. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause service failures...

CVE-2025-8036

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

CVE-2025-8036

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

UBUNTU-CVE-2025-8036

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

Mozilla Firefox ESR < 140.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-59 advisory. - Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140...

F5 Networks BIG-IP : c-ares vulnerability (K000149130)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10.8 / 16.1.6.1 / 17.1.3 / 17.5.1.2. It is, therefore, affected by a vulnerability as referenced in the K000149130 advisory. The c-ares function aresparsenaptrreply, which is used for parsing NAPTR responses, could be...

The vulnerability of the Vnet/IP SCADA system’s interface of Yokogawa CENTUM VP allows a intruder to trigger a service failure.

The vulnerability of the Vnet/IP SCADA system of Yokogawa CENTUM VP is related to an uncontrolled and unauthorized access. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending specially crafted packets...

The vulnerability of the Vnet/IP SCADA system’s interface of Yokogawa CENTUM VP allows a intruder to trigger a service failure.

The vulnerability of the Vnet/IP SCADA system of Yokogawa CENTUM VP is related to the incorrect processing of parameter length discrepancies. Exploiting this vulnerability allows a malicious actor to trigger a service failure by sending specially crafted packets...