CVE-2025-43931

flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

IBM Engineering Requirements Management DOORS 授权问题漏洞

IBM Engineering Requirements Management DOORS is a requirements management tool from International Business Machines IBM. An authorization issue vulnerability exists in IBM Engineering Requirements Management DOORS version 9.7.2.9, which stems from a misconfiguration that could lead to a...

CVE-2025-43930

Summary. Hashview 0.8.1 is affected by an account takeover risk in the password reset flow caused by an unconfigured SERVER_NAME, making reset behavior depend on the Host HTTP header. This misconfiguration can allow an attacker to exploit the password reset mechanism; exploitation details are not...

OESA-2025-1734 sudo security update

Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done. Security Fixes: Sudo before 1.9.17p1, when used with a sudoers file that...

WordPress CF7 7 Mailchimp Add-on plugin < 2.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin CF7 7 Mailchimp Add-on versions 2.4...

WordPress Easy Elements Hider plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Ryan Novotny in WordPress Plugin Easy Elements Hider versions = 2.0...

WordPress Bulk Featured Image plugin <= 1.2.4 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by greenhats in WordPress Plugin Bulk Featured Image versions = 1.2.4...

WordPress plugin MobiLoud 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Endress+Hauser MEAC300-FNADE4 安全漏洞

The Endress+Hauser MEAC300-FNADE4 is a cost-effective emissions data management computer from Endress+Hauser Vietnam. A security vulnerability exists in the Endress+Hauser MEAC300-FNADE4, which stems from an Apache misconfiguration, and can be exploited by an attacker to cause a directory to be...

WordPress RealHomes Theme <= 4.4.0 is vulnerable to Privilege Escalation

Software RealHomes Type Theme Vulnerable versions = 4.4.0 Fixed in 4.4.1 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2025-49867 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 9303a55298f9 Credits Frank Required privilege...

CVE-2025-27021

The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of service, and privilege escalation by...

CVE-2025-27021

The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of service, and privilege escalation by...

CVE-2025-27022

The CVE-2025-27022 entry concerns Infinera G42 WebGUI HTTP endpoint in version R6.1.3 with a path traversal vulnerability. Root cause: lack of sufficient validation of user-supplied input enables authenticated users to access files readable by the httpd service user, potentially downloading OS fi...

CVE-2025-27022 Path Traversal Vulnerability in Infinera G42

A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests. Details: Lack or insufficient validation of user-supplied input allows authenticated users to access all files on the target...

CVE-2025-27021 Operating System Misconfiguration in Infinera G42

The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of service, and privilege escalation by...

CVE-2025-27021

The CVE-2025-27021 entry affects Infinera G42 (version R6.1.3) due to a misconfiguration in sudoers that lets low-privileged OS users run devmem as superuser, enabling read/write access to arbitrary physical memory. This can lead to information disclosure, DoS, and privilege escalation by tamperi...

CVE-2023-47310

A misconfiguration in the default settings of MikroTik RouterOS 7 and fixed in v7.14 allows incoming IPv6 UDP traceroute packets...

Infinera G42 安全漏洞

Infinera G42 is a modular platform for optical networks from Infinera USA. A security vulnerability exists in Infinera G42 version R6.1.3, which stems from a misconfiguration and could lead to information disclosure and elevation of privilege...

CVE-2025-34064 OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket onelogin-adc-logs-production without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. The...

One Identity OneLogin AD Connector 安全漏洞

One Identity OneLogin AD Connector is a connector software from One Identity USA. A security vulnerability exists in the One Identity OneLogin AD Connector that stems from a misconfiguration of the cloud infrastructure leading to log data leakage...