CVE-2025-55082 Potential out of bound read and info leak in_nx_secure_tls_psk_identity_find()

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was a potential out of bound read in nxsecuretlsprocessclienthello because of a missing validation of PSK length provided in the user message...

CVE-2025-55082

NetX Duo (Eclipse Foundation ThreadX) before 6.4.4 is affected by an out-of-bounds read in _nx_secure_tls_process_clienthello() due to missing validation of PSK length in the user message. This is described across multiple sources (NVD, Red Hat, OSV, CVE lists, CNNVD). The impact is a potential i...

CVE-2025-26859

RemoteView PC Application Console versions prior to 6.0.2 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution...

CVE-2025-26861

RemoteCall Remote Support Program for Operator versions prior to 5.3.0 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution...

CVE-2025-26859

CVE-2025-26859 affects RSUPPORT’s RemoteView PC Application Console. Versions prior to 6.0.2 are vulnerable to an uncontrolled search path element (CWE-427) that can allow arbitrary code execution if a crafted DLL is placed in the application’s folder. The issue’s root cause is a perilous search ...

EUVD-2025-34519

The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks...

RSUPPORT RemoteCall Remote Support Program 代码问题漏洞

RSUPPORT RemoteCall Remote Support Program is a remote assistance software from the Korean company RSUPPORT. A code issue vulnerability exists in RSUPPORT RemoteCall Remote Support Program versions prior to 5.3.0, which stems from an uncontrolled search path element that could lead to the executi...

F5 Networks BIG-IP : BIG-IP Advanced WAF and ASM and NGINX App Protect DNS lookup vulnerability (K000148512)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.2 / 17.5.0. It is, therefore, affected by a vulnerability as referenced in the K000148512 advisory. When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery SSRF protection or when a...

F5 Networks BIG-IP : BIG-IP Advanced WAF and ASM vulnerability (K000154664)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10.8 / 17.1.3 / 17.5.1. It is, therefore, affected by a vulnerability as referenced in the K000154664 advisory. When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests...

CVE-2025-61805 Substance3D - Stager | Out-of-bounds Read (CWE-125)

Substance3D - Stager versions 3.1.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current...

EUVD-2025-34454

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the...

CVE-2025-54280 Substance3D - Viewer | Out-of-bounds Write (CWE-787)

Substance3D - Viewer versions 0.25.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

EUVD-2024-55032

Apache Geode web-api is vulnerable to Cross-site Scripting...

CVE-2025-11716

Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability affects Firefox 144 and Thunderbird 144...

EUVD-2025-34193

An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager SDM of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attack...

CVE-2025-11717

CVE-2025-11717 affects Mozilla Firefox versions earlier than 144. The issue occurs when switching between Android apps via the card carousel, causing a black screen for the card image if a password-related screen was the last used; before 144, the password edit screen was visible. Practical impac...

Ivanti EPMM 操作系统命令注入漏洞

Ivanti EPMM is a product from Ivanti USA that enables IT departments to set policies for mobile devices, applications and content. An operating system command injection vulnerability exists in Ivanti EPMM versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4, which stems from the presence of an OS...

Adobe FrameMaker 2020 < 16.0.10 (2020.0.10) / Adobe FrameMaker 2022 < 17.0.8 (2022.0.8) Arbitrary Code Execution (APSB25-101)

The version of Adobe FrameMaker installed on the remote Windows host is prior to Adobe FrameMaker 2020 16.0.10 / Adobe FrameMaker 2022 17.0.8. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb25-101 advisory. - Heap-based Buffer Overflow CWE-122 potentially leading ...

CVE-2025-62389

SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database...

CVE-2025-62363

yt-grabber-tui is a terminal user interface application for downloading videos. In versions before 1.0-rc, the application allows users to configure the path to the yt-dlp executable via the pathtoytdlp configuration setting. An attacker with write access to the configuration file or the filesyst...