16576 matches found
Devolutions Server <= 2025.2.15.0 / 2025.3.2.0 <= 2025.3.5.0 Multiple Vulnerabilities (DEVO-2025-0016)
The version of Devolutions Server installed on the remote host is prior to 2025.2.17.0, or 2025.3.x prior to 2025.3.6.0, and is, therefore, affected by multiple vulnerabilities: - Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged...
Ivanti Endpoint Manager < 2024 SU4 Multiple Vulnerabilities
The version of Ivanti Endpoint Manager running on the remote host is prior to 2024 SU34. It is, therefore, affected by multiple vulnerabilities: - Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary...
PT-2025-46941
Name of the Vulnerable Software and Affected Versions NCP-HG100 versions 1.4.48.16 and earlier Description An issue exists where special elements are not properly neutralized when used in operating system commands, potentially leading to OS Command Injection. A remote attacker who has valid...
CVE-2025-64446: Critical Vulnerability in Fortinet FortiWeb Exploited in the Wild
Overview On October 6, 2025, the cyber deception company Defused published a proof-of-concept exploit on social media that was captured by one of their Fortinet FortiWeb Manager honeypots. FortiWeb is a Web Application Firewall WAF product that is designed to detect and block malicious traffic to...
EUVD-2025-175377
Keyfactor SignServer before 7.3.1 has Incorrect Access Control, issue 3 of 3...
CVE-2025-47220
A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLESIGNATURECUSTOMIMAGEPATH, which exists in the PDFSigner and the PAdESSigner, can be set to any path without any restrictions by an admin user. In the case that the provided path points to an...
CVE-2025-64747 Directus Vulnerable to Stored Cross-site Scripting
Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS vulnerability exists in versions prior to 11.13.0 that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface...
CVE-2025-64117
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1761813675 and Tuleap Enterprise Edition prior to versions 16.13-5 and 16.12-8 don't have cross-site request forgery protection in the management of...
CVE-2025-9316
N-central 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4...
CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Wednesday added a critical security flaw impacting WatchGuard Fireware to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The vulnerability in question is CVE-2025-9242 CVSS score: 9.3, an...
Siemens SIMATIC S7-1500 NULL Pointer Dereference (CVE-2020-13632)
ext/fts3/fts3snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo query. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if descripti...
HP Integrated Lights-Out Improper Input Validation (CVE-2022-28636)
A potential local arbitrary code execution and a local denial of service DoS vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to potentially execute arbitra...
HP Integrated Lights-Out Buffer Copy without Checking Size of Input (CVE-2021-29202)
"A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4 %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504415; scriptversion"1.1"; scriptsetattributeattribute:"pluginmodificationdate", value:"2025/11/13";...
Siemens SIMATIC S7-1500 Use After Free (CVE-2021-20232)
A flaw was found in gnutls. A use after free issue in clientsendparams in lib/ext/presharedkey.c may lead to memory corruption and other potential consequences. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 809...
CVE-2025-47221
Keyfactor SignServer versions prior to 7.3.2 are vulnerable to an arbitrary file write due to improper access control. The properties ARCHIVETODISK_FILENAME-PATTERN , ARCHIVETODISK_PATH_BASE , and ARCHIVETODISK_PATH_PATTERN can be set to any path, including those pointing to existing files. A use...
Dell Alienware Command Center 安全漏洞
DELL Alienware Command Center is Dell's proprietary control software for Alienware-branded computers, which is used to customize hardware features, optimize performance and manage game settings. DELL Alienware Command Center has a temporary file insecurity vulnerability that can be exploited by...
Improper Verification of Cryptographic Signature
Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via incomplete validation of attestation documents in the attestation verification process. An attacker can cause clients to trust enclaves that do not meet expected integrity guarantees ...
CVE-2025-64186 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves
Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...
