CVE-2025-1418 Information disclosure in Proget MDM

A low-privileged user can access information about profiles created in Proget MDM Mobile Device Management, which contain details about allowed/prohibited functions. The profiles do not reveal any sensitive information including their usage in connected devices. This issue has been fixed...

CVE-2025-1418

CVE-2025-1418 affects the Proget MDM server (Konsola Proget). A low-privileged user could read information about profiles (which describe allowed/prohibited functions). The issue does not expose sensitive data about devices in the initial description, but it leaks profile metadata. The entry is f...

CVE-2025-1417

CVE-2025-1417 affects Proget MDM using the Konsola Proget server component. A low-privileged user can access change-logs for backups of all managed devices, exposing user IDs, email addresses, first and last names, and device UUIDs (the UUID could enable CVE-2025-1416). Exploitation requires the ...

CVE-2025-1417 Information disclosure in Proget MDM

In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM Mobile Device Management. This information include user ids, email addresses, first names, last names and device UUIDs. The last one can be used for exploitation of...

CVE-2025-1416 Password disclosure in Proget MDM

In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM Mobile Device Management. For it to happen, they must know the UUIDs of targetted devices, which might be obtained by exploiting CVE-2025-1415 or CVE-2025-141...

CVE-2025-1416 Password disclosure in Proget MDM

In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM Mobile Device Management. For it to happen, they must know the UUIDs of targetted devices, which might be obtained by exploiting CVE-2025-1415 or CVE-2025-141...

CVE-2025-1416

CVE-2025-1416 affects Proget MDM (Konsola Proget server). A low-privilege user can retrieve passwords for managed devices and then use MDM functions restricted to higher-privilege users. Exploitation requires knowing the UUIDs of targeted devices, which may be obtained via related flaws CVE-2025-...

CVE-2025-1415 Information disclosure in Proget MDM

A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM Mobile Device Management, as well as details of the devices like their UUIDs needed for exploitation of CVE-2025-1416. In order to perform the attack, one has to know a taskid, but since...

CVE-2025-1415

In Proget MDM, the CVE-2025-1415 issue concerns a low-privileged user who can retrieve information about tasks run on managed devices and obtain device UUIDs needed for exploitation of CVE-2025-1416. The attack requires knowing a task_id, but brute-forcing is possible due to lack of request limit...

PT-2025-22329

Name of the Vulnerable Software and Affected Versions Proget MDM versions prior to 2.17.5 Description A low-privileged user can obtain information about tasks executed on devices controlled by Proget MDM, as well as details of the devices like their UUIDs. To perform the attack, an attacker needs...

PT-2025-22349 · Unknown · Proget Mdm

Name of the Vulnerable Software and Affected Versions: Proget MDM versions prior to 2.17.5 Description: A low-privileged user can access information about changes contained in backups of all devices managed by the MDM, including user ids, email addresses, first names, last names, and device UUIDs...

CVE-2025-26168

IXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, ca...

CVE-2025-46571 Open WebUI vulnerable to limited stored XSS vila uploaded html file

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open t...

CVE-2025-43595

An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the 'Online Backup' folder. Upgrade to MSP360 Backup 4.4 released on 2025-04-22...

CVE-2025-43595 MSP360 Backup (for Linux) insecure filesystem permissions

An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the 'Online Backup' folder. Upgrade to MSP360 Backup 4.4 released on 2025-04-22...

CVE-2025-46544

In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles...

CVE-2025-0101

A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes some functions to work unexpected or stop working at all. Both during runtime and after a restart...

CVE-2025-46544

In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles...

Sherpa Orchestrator 安全漏洞

Sherpa Orchestrator is an IT management software from Sherpa for automating IT processes and workflow management. A security vulnerability exists in Sherpa Orchestrator version 141851, which stems from the possibility that a low-privileged user could elevate privileges by creating new users and...

CVE-2025-46544

CVE-2025-46544 affects Sherpa Orchestrator 141851. A low-privileged user can elevate privileges by creating new users and roles, as documented by multiple sources in connected documents. The vulnerability description is consistent across feeds; no exploits are provided in the documents. Some advi...