CVE-2025-10020: Improper Neutralization of Special Elements used in a Command

Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component...

CVE-2025-9428: Improper Neutralization of Special Elements used in an SQL Command

Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api...

ZOHO ManageEngine Analytics Plus 安全漏洞

ZOHO ManageEngine Analytics Plus is a self-service IT analytics solution from ZOHO. Get a better view of your IT data with rich visualizations and dashboards. ZOHO ManageEngine Analytics Plus SQL Injection Vulnerability, the vulnerability is due to insufficient input validation. An attacker can...

CVE-2025-54957

An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evopriv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can...

EUVD-2025-35059

An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evopriv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can...

The vulnerability of the TCP/IP protocol stack implementation in the real-time operating system FreeRTOS-Plus-TCP allows a attacker to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the TCP/IP protocol stack implementation in the real-time operating system FreeRTOS-Plus-TCP lies in the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and accessibility ...

CVE-2025-54957

An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evopriv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can...

The vulnerability of the TCP/IP protocol stack implementation in the real-time operating system FreeRTOS-Plus-TCP allows a attacker to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the TCP/IP protocol stack implementation in the real-time operating system FreeRTOS-Plus-TCP lies in the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and accessibility ...

Rockwell Automation PanelView Plus 7 Performance Series B Authentication Bypass Vulnerability

Rockwell Automation PanelView Plus 7 Performance Series B is a versatile HMI application from Rockwell Automation. An authentication bypass vulnerability exists in Rockwell Automation PanelView Plus 7 Performance Series B, which can be exploited by an attacker to cause unauthorized access,...

WordPress WP Private Content Plus plugin <= 3.6.2 - Password Protection Bypass vulnerability

Password Protection Bypass vulnerability discovered by Lorenzo Camilli in WordPress Plugin WP Private Content Plus versions = 3.6.2...

Rockwell Automation FactoryTalk View Machine Edition and PanelView Plus 7

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to access to the device's file system. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize...

CVE-2025-9063

An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows unauthorized access to the PanelView Plus 7 Series B, including access to the file system, retrieval of diagnostic information, event logs,...

CVE-2025-10682 TARIFFUXX <= 1.4 - Authenticated (Contributor+) SQL Injection via tariffuxx_configurator Shortcode

The TARIFFUXX plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4. This is due to insufficient neutralization of user-supplied input used directly in SQL queries. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

WordPress XStore theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion vulnerability

Authenticated Subscriber+ Local File Inclusion vulnerability discovered by khanhhnahk1 in WordPress Theme XStore versions = 9.5.4...

CVE-2025-58725 Windows COM+ Event System Service Elevation of Privilege Vulnerability

...

MITRE CVE-2025-54957: Integer overflow in Dolby Digital Plus audio decoder

Deserialization of untrusted data in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally...

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locally...

CVE-2025-9063

An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows unauthorized access to the PanelView Plus 7 Series B, including access to the file system, retrieval of diagnostic information, event logs,...

CVE-2025-9063

An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows unauthorized access to the PanelView Plus 7 Series B, including access to the file system, retrieval of diagnostic information, event logs,...

CVE-2025-9063

CVE-2025-9063 concerns an authentication bypass in the FactoryTalk View Machine Edition Web Browser ActiveX control, enabling an unauthenticated attacker on the same network to gain access to the PanelView Plus 7 Series B file system, diagnostic information, and event logs. Connected sources conf...