CVE-2025-67718 Formio improperly authorized permission elevation through specially crafted request path

Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized...

CVE-2025-67718 Formio improperly authorized permission elevation through specially crafted request path

Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized...

Moodle Information Disclosure

The vulnerability in the virtual learning environment Moodle is related to the disclosure of information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

GHSA-M654-769V-QJV7 Formio improperly authorized permission elevation through specially crafted request path

Security Advisory: Unauthorized permission elevation through specially crafted request path Summary: A flaw in path handling could allow an attacker to access protected API endpoints by sending a crafted request path. This issue could result in unauthorized data disclosure under certain...

tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE

A directory traversal vulnerability in Apache Tomcat caused by improper URL normalization during request rewriting. When specific rewrite rules are used, an attacker could craft a malicious request to bypass access restrictions and reach protected directories such as /WEB-INF/ or /META-INF/. If...

EUVD-2025-202343

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access. An attacker could leverage this vulnerability to gain unauthorized access by exploiting improperly stored or...

Defender Firewall Service Disclosure

The vulnerability of the Defender Firewall Service for Windows operating systems is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

DirectX Disclosure Protected Information

The vulnerability of the DirectX component in Windows operating systems is related to the disclosure of information. Exploiting this vulnerability can allow a remote attacker to disclose the protected information...

CVE-2025-64898: Insufficiently Protected Credentials

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access. An attacker could leverage this vulnerability to gain unauthorized access by exploiting improperly stored or...

PT-2025-50565

Name of the Vulnerable Software and Affected Versions Form.io versions 3.5.6 and below, and 4.0.0-rc.1 through 4.4.2 Description A flaw in path handling exists that could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized...

tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE

A directory traversal vulnerability in Apache Tomcat caused by improper URL normalization during request rewriting. When specific rewrite rules are used, an attacker could craft a malicious request to bypass access restrictions and reach protected directories such as /WEB-INF/ or /META-INF/. If...

tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE

A directory traversal vulnerability in Apache Tomcat caused by improper URL normalization during request rewriting. When specific rewrite rules are used, an attacker could craft a malicious request to bypass access restrictions and reach protected directories such as /WEB-INF/ or /META-INF/. If...

CVE-2025-66202

Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8,...

Qualcomm Disclosure Info Disclosure

The vulnerability of embedded software developed by Qualcomm relates to the exposure of system data to the controlled area. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

Qualcomm Pointer Assignment Disclosure

The vulnerability of embedded software in Qualcomm chips relates to unreliable pointer handling. Exploiting this vulnerability can allow attackers to disclose protected information...

IntraService Customer Interaction System Authentication Bypass

The vulnerability of the IntraService customer interaction system relates to the bypassing of authentication processes through spoofing. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Apache OpenOffice Auth Bypass Info Disclosure

The vulnerability of the Apache OpenOffice office software is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to disclose protected information through a specially created file...

IntraService customer interaction system Script Removal Unauthorized Access

The vulnerability of the IntraService customer interaction system is related to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

IntraService Customer Interaction System Unauthorized Access

The vulnerability of the IntraService customer interaction system is related to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Astro 安全漏洞

Astro is an Astro open source web framework for content-driven websites. A security vulnerability exists in Astro versions 5.15.7 and below, which stems from a double URL encoding bypass that could allow an unauthenticated attacker to access protected routes...