5910 matches found
CVE-2025-20193
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an injection attack against an affected device.r This vulnerability is due to insufficient input validation. An attacker could exploit this...
CVE-2025-47423
CVE-2025-47423 affects Personal Weather Station Dashboard (12_lts). A directory traversal fault in /others/_test.php (test parameter) allows unauthenticated remote readers to access arbitrary files, including server private keys. Root cause: insufficient sanitization of the test parameter enablin...
CVE-2025-47423
Personal Weather Station Dashboard 12lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/test.php, as demonstrated by reading the server's private SSL key in cleartext...
SysAid On-Prem 安全漏洞
SysAid On-Prem is a locally deployed IT Service Management ITSM platform from SysAid Israel. A security vulnerability exists in SysAid On-Prem versions 23.3.40 and earlier, which stems from an unvalidated XML external entity vulnerability in the Server URL handling feature that could lead to...
About Remote Code Execution & Arbitrary File Reading – Apache HTTP Server (CVE-2024-38475) vulnerability
About Remote Code Execution & Arbitrary File Reading - Apache HTTP Server CVE-2024-38475 vulnerability. Improper escaping of output in modrewrite module leads to remote code execution or arbitrary file reading. Successful exploitation does not require authentication. Apache HTTP Server 2.4.60,...
Security update for java-17-openjdk
This update for java-17-openjdk fixes the following issues: Update to upstream tag jdk-17.0.15+6 April 2025 CPU CVEs: CVE-2025-21587: Fixed JSSE unauthorized access, deletion or modification of critical data bsc1241274 CVE-2025-30691: Fixed Oracle Java SE Compiler Unauthorized Data Access...
CVE-2024-49835
Memory corruption while reading secure file...
CVE-2025-2905
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity XXE resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: Read sensitive files from the...
CVE-2025-2905
The CVE-2025-2905 entry describes an XML External Entity (XXE) vulnerability in the WSO2 API Manager gateway component due to insufficient validation of XML input. The issue allows unauthenticated remote attackers to read server filesystem files and perform denial-of-service (DoS) attacks. Affect...
SUSE-SU-2025:1440-1 Security update for libxml2
This update for libxml2 fixes the following issues: - CVE-2025-32414: Fixed an out-of-bounds read when parsing text via the Python API. bsc1241551 - CVE-2025-32415: Fixed a crafted XML document may lead to a heap-based buffer under-read. bsc1241453...
CVE-2025-3707
The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL command to read database contents...
Dassault Systèmes SOLIDWORKS eDrawings 安全漏洞
Dassault Systèmes SOLIDWORKS eDrawings is a collaboration tool for viewing, sharing and labeling 2D/3D design files from Dassault Systèmes, France. A security vulnerability exists in Dassault Systèmes SOLIDWORKS eDrawings version 2025, which stems from post-release reuse during SLDPRT file readin...
Dassault Systèmes SOLIDWORKS eDrawings 安全漏洞
Dassault Systèmes SOLIDWORKS eDrawings is a collaboration tool for viewing, sharing and labeling 2D/3D design files from Dassault Systèmes, France. A security vulnerability exists in Dassault Systèmes SOLIDWORKS eDrawings version 2025, which originates from an out-of-bounds write during OBJ file...
CVE-2022-49769
In the Linux kernel, the following vulnerability has been resolved: gfs2: Check sbbsizeshift after reading superblock Fuzzers like to scribble over sbbsizeshift but in reality it's very unlikely that this field would be corrupted on its own. Nevertheless it should be checked to avoid the...
CVE-2025-27409
CVE-2025-27409 affects Joplin Server prior to version 3.3.3, where path traversal is possible when static files are requested under css/pluginAssets or js/pluginAssets. The default route’s findLocalFile calls localFileFromUrl and, if it returns a path, the result is sent without validating path t...
CVE-2025-27409 Joplin Server Vulnerable to Path Traversal
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with css/pluginAssets or js/pluginAssets. The findLocalFile function i...
The compatibility subsystem for running Linux applications allows Windows Subsystem for Linux (WSL) operating systems. This enables attackers to increase their privileges.
The vulnerability of the compatibility subsystem for running Linux applications in Windows Subsystem for Linux WSL operating systems is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to increase their privileges...
Novel-Plus 安全漏洞
Novel-Plus is an online social reading and writing platform from Novel-Plus, Inc. Novel-Plus has a security vulnerability that stems from improper authorization...
