CVE-2025-13492

HP Image Assistant is affected in versions prior to 5.3.3. The vulnerability stems from a race condition during package installation that could allow a local attacker to escalate privileges (local, high impact). No exploitation details are provided in the documents; exposure depends on attacker a...

CVE-2025-10304 Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.8 - Missing Authorization to Unauthenticated Backup Failure

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the processstatusunlink function in all versions up to, and including, 2.3.8. This makes it possible for unauthenticated...

Romm 安全漏洞

Romm is a beautiful, powerful, self-hostable ROM manager and player open-sourced by The RomM Project. A security vulnerability exists in Romm versions prior to 4.4.1 and prior to 4.4.1-beta.2, which stems from a lack of ownership validation and could lead to the deletion of other users' collectio...

PT-2025-48976

Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing directives...

Mozilla Rhino 资源管理错误漏洞

Mozilla Rhino is an open source JavaScript engine from Mozilla Corporation. A resource management error vulnerability exists in Mozilla Rhino versions 1.8.1, 1.7.15.1, and prior to 1.7.14.1, which stems from the improper handling of floating point numbers by the toFixed function, which could lead...

PT-2025-48791

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the process status unlink function in all versions up to, and including, 2.3.8. This makes it possible for unauthenticate...

PT-2025-48939

Name of the Vulnerable Software and Affected Versions Abacre Restaurant Point of Sale POS versions up to 15.0.0.1656 Description The application stores sensitive information, specifically valid device-bound license keys, in process memory during an activation attempt. This could allow unauthorize...

CVE-2025-65320

CVE-2025-65320 affects Abacre Restaurant Point of Sale (POS) up to version 15.0.0.1656. The root cause is Cleartext Storage of Sensitive Information in Memory: valid device-bound license keys are left in process memory during an activation attempt. Several connected sources corroborate that all v...

Socomec DIRIS Digiware M-70 Denial of Service Vulnerability (CNVD-2025-30457)

The Socomec DIRIS Digiware M-70 is a communication gateway device that serves as an access point for the DIRIS Digiware system, which combines 24VDC power and communication functions in a single unit. A denial of service vulnerability exists in the Socomec DIRIS Digiware M-70, which stems from...

Fedora 42 : restic (2025-65fc438cba)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-65fc438cba advisory. Update to 0.18.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

HCLTech DRAGON 安全漏洞

HCLTech DRAGON is a data retention / archiving / mass data storage and retrieval solution from HCL Corporation, USA. A security vulnerability exists in HCLTech DRAGON versions prior to 7.6.0, which stems from a missing instruction and could lead to the remote execution of arbitrary code...

CVE-2025-65320

Abacre Restaurant Point of Sale POS up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory during an activation attempt...

Abacre Restaurant Point of Sale 安全漏洞

Abacre Restaurant Point of Sale is a restaurant point of sale software from Abacre. A security vulnerability exists in Abacre Restaurant Point of Sale 15.0.0.1656 and earlier versions, which originates from the explicit storage of sensitive information in memory and could lead to information...

CVE-2025-65320

Abacre Restaurant Point of Sale POS up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory during an activation attempt...

SUSE SLED15: libruby2_5-2_5 / ruby2.5 / ruby2.5-devel / ruby2.5-devel-extra / etc (SUSE-SU-2025:4264-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4264-1 advisory. - CVE-2024-35221: Fixed remote DoS via YAML manifest bsc1225905 - CVE-2024-47220: Fixed HTTP request smuggling...

Sulu XSS Vulnerability (GHSA-255w-87rh-rg44)

Sulu is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sulu:sulu"; if...

DoS (Denial of Service) com.fasterxml.jackson.core:jackson-databind Dependency in Crowd Data Center and Server

This High severity DoS Denial of Service vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This Improper Authorization vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expos...

CVE-2025-13835

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through = 2.1.20...

UBUNTU-CVE-2025-65187

A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and it executes whenever the page is viewed...

EUVD-2025-200228

Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowSupervisorParameters' function, there is an unlimited user input that is copied to a fixed-size buffer via 'sprintf'. The 'GetParametermeter' function retrieves the user input, which is directly...