SeaCMS 安全漏洞

SeaCMS is a free, open source web content management system written in PHP by SeaCMS, Inc. The system is primarily designed to manage video-on-demand resources. A security vulnerability exists in SeaCMS version 13.1, which stems from an information leak in the adminsafe.php component that could...

PT-2025-40574

Name of the Vulnerable Software and Affected Versions HCL MyXalytics version 6.6 Description The software is susceptible to a Mass Assignment issue. This happens when user-supplied data is automatically mapped to application objects without sufficient validation or access controls, potentially...

WordPress plugin Wp cycle text announcement SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A SQL injection...

MeteoBridge template.cgi command injection

Added: 10/03/2025 CVE: CVE-2025-4008 Background MeteoBridge is a device which connects personal weather stations to public weather networks. Problem A command injection vulnerability in the MeteoBridge web interface could allow remote, unauthenticated attackers to execute arbitrary commands by...

CVE-2025-34182

In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the parameter ptpid is not sanitized of HTML-related characters/strings. This value is directly displayed when visiting the page/interfacesassign.php, which can result in stored cross-site...

CVE-2025-54087

CVE-2025-54087 describes a server-side request forgery in Ivanti Secure Access prior to version 14.10. The vulnerability allows administrators to publish a crafted HTTP request originating from the Secure Access server, with attack complexity high, no required user interaction beyond administrati...

CVE-2025-49090

The Matrix specification before 1.16 i.e., with a room version before 12 and State Resolution before 2.1 has deficient state resolution...

CVE-2025-59762

CVE-2025-59762 is a reflected XSS in AndSoft e-TMS v25.03. The vulnerability stems from insufficient validation of the parameters l, demo, demo2, TNTLOGIN, UO and SuppConn in /clt/LOGINFRM_DLG.ASP, enabling an attacker to inject JavaScript via a malicious URL. Documented across NVD/CVE records an...

WordPress Jock On Air Now (JOAN) plugin <= 6.0.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Jock On Air Now JOAN versions = 6.0.4...

CVE-2025-54292 Client-Side Path Traversal in LXD-UI

Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths...

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands

...

Cisco Access Point Software Intermittent IPv6 Gateway Change (cisco-sa-ap-ipv6-gw-tUAzpn9O)

According to its self-reported version, Cisco Access Point Software Intermittent IPv6 Gateway Change is affected by a vulnerability. - A vulnerability in the IPv6 Router Advertisement RA packet processing of Cisco Access Point Software could allow an unauthenticated, adjacent attacker to modify t...

PT-2025-40335

Name of the Vulnerable Software and Affected Versions Canonical LXD LXD-UI versions prior to 6.5 Canonical LXD LXD-UI versions prior to 5.21.4 Description A path traversal issue exists in Canonical LXD LXD-UI. Remote authenticated attackers can potentially access or modify unintended resources by...

LXD 安全漏洞

LXD is a Canonical open source container for managing applications on Linux-based systems. A security vulnerability exists in LXD versions prior to 6.5 and 5.21.4, which stems from an unauthenticated image export API that could lead to information disclosure...

Oracle Linux 9 : perl-JSON-XS (ELSA-2025-17162)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-17162 advisory. 1:4.04-1 - Update to 4.04 - Fix CVE-2025-40928 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note tha...

CVE-2025-59150

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed i...

CVE-2025-59149 Suricata: Stack buffer overflow in rule parser when processing long keywords with transforms

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attributetype which is long with transforms can lead to a stack buffer overflow during Suricata startup or duri...

CVE-2025-59148 Suricata's improper use of entropy keyword can lead to a NULL-ptr deref

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed ...

CVE-2025-38500 affecting package kernel for versions less than 6.6.104.2-1

CVE-2025-38500 affecting package kernel for versions less than 6.6.104.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-39701 affecting package kernel for versions less than 6.6.104.2-1

CVE-2025-39701 affecting package kernel for versions less than 6.6.104.2-1. An upgraded version of the package is available that resolves this issue...