CVE-2025-1425

A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the device.This issue affects InkPad Color 3: U743k3.6.8.3671...

CVE-2025-1425

The CVE-2025-1425 case concerns a sudo privilege misconfiguration in PocketBook InkPad Color 3 (Linux, ARM; affected build U743k3.6.8.3671). The issue enables an attacker to read file contents on the device due to improper sudo permissions. Documented impacts are confined to confidentiality expos...

Linux Distros Unpatched Vulnerability : CVE-2018-10863

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/store/transfer directory,...

PocketBook InkPad Color 3 安全漏洞

PocketBook InkPad Color 3 is a waterproof e-reader with a color display from PocketBook. It is used for reading eBooks, playing audiobooks, and more. A security vulnerability exists in the PocketBook InkPad Color 3 U743k version 3.6.8.3671, which stems from a misconfiguration of permissions and...

PocketBook InkPad Color 3 安全漏洞

PocketBook InkPad Color 3 is a waterproof e-reader with a color display from PocketBook. It is used for reading eBooks, playing audiobooks, and more. A security vulnerability exists in the PocketBook InkPad Color 3 U743k version 3.6.8.3671, which stems from a misconfiguration of Sudo permissions...

PYSEC-2025-25

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

CVE-2025-25302 Rembg CORS misconfiguration

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

CVE-2025-25302 Rembg CORS misconfiguration

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

CVE-2024-8261

Authorization Bypass Through User-Controlled Key vulnerability in Proliz Software OBS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects OBS: before 24.0927...

Rembg 访问控制错误漏洞

Rembg is a tool for removing image backgrounds by the individual developer Daniel Gatis. An access control error vulnerability exists in Rembg version 2.0.57 and earlier, which stems from a misconfiguration of the CORS middleware that allows any website to send cross-site requests, potentially...

CVE-2024-38290

In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met...

CVE-2024-38290

In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met...

CVE-2025-27154 Spotipy's cache file, containing spotify auth token, is created with overly broad permissions

Spotipy is a lightweight Python library for the Spotify Web API. The CacheHandler class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has rw-r--r-- 644 permissions by default, when it could be locked down to rw------- 600 permissions. This leads to overly...

Extreme Networks Extreme ExtremeCloud IQ Site Engine 信息泄露漏洞

Extreme Networks ExtremeCloud IQ Site Engine Extreme Networks XIQ-SE is a site engine from Extreme Networks, Inc. providing end-to-end management of wired and wireless devices from the edge to the data center and across multi-vendor environments. A security vulnerability exists in Extreme Network...

CVE-2024-38290

In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met...

CVE-2024-38290

The CVE-2024-38290 issue affects Extreme Networks’ XIQ-SE before 24.2.11, arising from a server misconfiguration that may allow user enumeration under specific conditions. Impact is limited to misconfiguration-driven exposure of usernames; no exploitation details are provided beyond this behavior...

PT-2025-9026 · Xiq-Se · Xiq-Se

Name of the Vulnerable Software and Affected Versions: XIQ-SE versions prior to 24.2.11 Description: A server misconfiguration in XIQ-SE may allow user enumeration under specific conditions. Recommendations: For versions prior to 24.2.11, update to version 24.2.11 or later to resolve the issue...

CVE-2024-38290

In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met...

CVE-2025-26965

CVE-2025-26965 is an Auth bypass/IDOR flaw in the Amelia Booking plugin for WordPress (Booking for Appointments & Events Calendar – Amelia). The vulnerability affects the plugin’s cases prior to a patched release (vulnerable range includes

CVE-2025-26911

CVE-2025-26911 involves System Dashboard (system-dashboard) experiencing exposure of sensitive information due to an access-control misconfiguration. The issue affects System Dashboard versions up to and including 2.8.18 (listed as from n/a through