CVE-2025-54253

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user...

WordPress Code Engine Plugin <= 0.3.3 - Remote Code Execution (RCE) Vulnerability

Remote Code Execution RCE Vulnerability discovered by theviper17 in WordPress Plugin Code Engine versions = 0.3.3...

IBM WebSphere Application Server（WAS）和IBM WebSphere Application Server Liberty 安全漏洞

IBM WebSphere Application Server WAS and IBM WebSphere Application Server Liberty are both products of International Business Machines IBM.IBM WebSphere Application Server is an application server IBM WebSphere Application Server is an application server product. The product is a platform for...

github.com/go-acme/lego/v4/acme/api does not enforce HTTPS

Summary It was discovered that the github.com/go-acme/lego/v4/acme/api package thus the lego library and the lego cli as well don't enforce HTTPS when talking to CAs as an ACME client. Details Unlike the http-01 challenge which solves an ACME challenge over unencrypted HTTP, the ACME protocol...

Adobe Experience Manager 6.0.0.0 < 6.5.24.0 Multiple Vulnerabilities (APSB25-82)

The version of Adobe Experience Manager installed on the remote host is prior to 6.5.24.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB25-82 advisory. - Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External...

Microsoft Exchange Server 授权问题漏洞

Microsoft Exchange Server is a set of e-mail service programs from Microsoft. It provides email access, storage, forwarding, voicemail, email filtering and screening, and other features. An authorization issue vulnerability exists in Microsoft Exchange Server, which stems from a mixed deployment...

Mastodon 安全漏洞

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A security vulnerability exists in Mastodon versions 4.2.24 and earlier, 4.3.11 and earlier, and 4.4.3 and earlier, which stems from a rate-limiting misconfiguration and could lead to a...

CVE-2025-54879 Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the...

CVE-2025-54253

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user...

CVE-2025-54253

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user...

CVE-2025-54253

CVE-2025-54253 affects Adobe Experience Manager (AEM) Forms on JEE, up to version 6.5.23, via an OGNL injection that enables unauthenticated RCE by reaching the /adminui/debug endpoint. Several connected sources confirm an unsafe evaluation path (OGNL/Struts-like) that can execute arbitrary OS co...

CVE-2025-54253 Adobe Experience Manager | Incorrect Authorization (CWE-863)

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user...

CVE-2025-54253 Adobe Experience Manager | Incorrect Authorization (CWE-863)

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user...

Misconfigurations Are Not Vulnerabilities: The Costly Confusion Behind Security Risks

In SaaS security conversations, "misconfiguration" and "vulnerability" are often used interchangeably. But they're not the same thing. And misunderstanding that distinction can quietly create real exposure. This confusion isn't just semantics. It reflects a deeper misunderstanding of the shared...

Adobe Experience Manager 安全漏洞

Adobe Experience Manager is a content management solution from Adobe designed to help organizations efficiently create, manage and deliver cross-channel content while integrating business solutions to enhance the customer experience. A code execution vulnerability exists in Adobe Experience Manag...

PT-2025-31949

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.23 and earlier Description Adobe Experience Manager versions 6.5.23 and earlier are affected by a misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage th...

CVE-2013-10052

ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw enables local attackers with shell...

CVE-2013-10052 ZPanel zsudo Local Privilege Escalation

ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw enables local attackers with shell...

CVE-2013-10052

CVE-2013-10052 concerns ZPanel’s zsudo helper. A misconfiguration in /etc/sudoers lets low-privilege users run arbitrary commands as root, enabling local privilege escalation by writing a payload to a writable dir and executing it via zsudo. Documented impact includes post-exploitation scenarios ...

CVE-2025-51387

The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses. Specifically, the following insecure settings were observed: RunAsNode is enabled and EnableNodeCliInspectArguments is not disabled. These configurations allow the application to be...