WhatsApp Desktop for Mac 2.22.25.2 < 2.25.21.78 Incorrect Authorization (August Update)

The version of WhatsApp Desktop installed on the remote host is 2.22.25.2 prior to 2.25.21.78. It is, therefore, affected by a vulnerability as referenced in the August update advisory: - Incomplete authorization of linked device synchronization messages in WhatsApp for Mac v2.25.21.78 could have...

CVE-2025-7106

CVE-2025-7106 : In danny-avila/librechat, an authorization bypass is caused by the checkAccess function in api/server/middleware/roles/access.js using permissions.some() to validate required permissions. This logic can grant access if any one of multiple permissions is present, allowing users wit...

BIT-MONGODB-2024-3372 MongoDB Server may have unexpected application behaviour due to invalid BSON

Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior including unavailability of serverStatus responses. This issue affects MongoDB Server v7.0 versions prior t...

DNN 跨站脚本漏洞

DNN also known as DotNetNuke is a set of American DNN company by Microsoft support, based on the ASP.NET platform of open source content management system CMS. The system is easy to install, scalable, feature-rich and so on. A cross-site scripting vulnerability exists in DNN versions prior to...

Conventional Changelog 参数注入漏洞

Conventional Changelog is an open source update log generation tool from Conventional Changelog. A parameter injection vulnerability exists in Conventional Changelog versions prior to 2.0.0 that stems from not cleaning or validating user input in the getTags API, which could lead to a parameter...

Mesh Connect JS SDK 跨站脚本漏洞

Mesh Connect JS SDK is a Java library from Mesh open source. A cross-site scripting vulnerability exists in Mesh Connect JS SDK versions prior to 3.3.2, which stems from the createLink.openLink function not being cleaned up for the URL protocol, which could lead to the execution of arbitrary...

PT-2025-38697

Name of the Vulnerable Software and Affected Versions PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS Student Affairs Information System versions prior to v26.0328 Description An authorization bypass exists due to a user-controlled key issue in OBS Student Affairs Information System...

CubeCart 安全漏洞

CubeCart is an e-commerce software from CubeCart Open Source. A security vulnerability exists in CubeCart versions prior to 6.5.11, which stems from a product review feature that does not properly clean up user input and could lead to a cross-site scripting attack...

CVE-2025-59352

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal...

CVE-2025-34198

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.951 and Application prior to 20.0.2368 VA and SaaS deployments contain shared, hardcoded SSH host private keys in the appliance image. The same private host keys RSA, ECDSA, and ED25519 are present across...

CVE-2025-26516

CVE-2025-26516 affects StorageGRID (formerly StorageGRID Webscale); versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Denial of Service on the Admin node when exploited by an unauthenticated attacker. The available documents do not specify the exact root cause or exploitation details....

CVE-2025-34197 Vasion Print (formerly PrinterLogic) Undocumented Local Account with Hardcoded Password and Passwordless sudo

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.951, Application prior to 20.0.2368 VA and SaaS deployments contain an undocumented local user account named ubuntu with a preset password and a sudoers entry granting that account passwordless root privileges ubuntu...

CVE-2025-34197

CVE-2025-34197 affects Vasion Print Virtual Appliance Host &lt; 22.0.951 and Vasion Print Application

Snipe-IT allows unsafe deserialization

Snipe-IT before 8.1.18 allows unsafe deserialization...

PT-2025-38502

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.1.18 Description Snipe-IT is susceptible to a cross-site scripting XSS issue. Recommendations Update Snipe-IT to version 8.1.18 or later...

PT-2025-38608

Name of the Vulnerable Software and Affected Versions Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.843 Vasion Print Application versions prior to 20.0.1923 Description Vasion Print formerly PrinterLogic Virtual Appliance Host and Application contain an arbitrar...

PT-2025-38596

Name of the Vulnerable Software and Affected Versions Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.951 Vasion Print formerly PrinterLogic Application versions prior to 20.0.2368 Description Vasion Print formerly PrinterLogic Virtual Appliance Host and Applicati...

Greenshot < 1.3.301 Deserialization of Untrusted Data (CVE-2025-59050)

The Greenshot installation on the remote Windows host is prior to 1.3.301. It is, therefore, affected by a deserialization of untrusted data vulnerability: - Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WMCOPYDATA message using BinaryFormatter.Deserialize...

The vulnerability of the Tenda G3 wireless access point’s microprogramming software, related to the use of pre-installed credentials, allows a hacker to bypass existing security restrictions and gain root access to the system.

The vulnerability of the Tenda G3 wireless access point’s microprogramming software relates to the use of pre-installed credentials. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and gain access to the system with root privileges...

CVE-2025-34185

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a pre-authentication file disclosure vulnerability via the 'dblog' POST parameter. Remote attackers can retrieve arbitrary files from the server, exposing sensitive system information and credentials...