10531 matches found
awesome-mobile-security
This is a curated repository of mobile security resources, specifically for Android and iOS. It aggregates various tools and references from their original owners, serving as a centralized hub for mobile security-related information. The repository does not contain any exploit code or tools but...
PT-2025-31002 · Chancms · Chancms
Name of the Vulnerable Software and Affected Versions: ChanCMS versions up to 3.1.2 Description: A critical server-side request forgery SSRF vulnerability exists in the getPages function of the /cms/collect/getPages file. Manipulation of the targetUrl argument can lead to unauthorized access to...
DEBIAN-CVE-2025-38419
In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Cleanup acquired resources when rprochandleresources fails in rprocattach When rproc-state = RPROCDETACHED and rprocattach is used to attach to the remote processor, if rprochandleresources returns a failure, th...
PT-2025-30743
Name of the Vulnerable Software and Affected Versions Kron PAM versions prior to 3.7 Description Kron PAM is susceptible to a denial-of-service DoS attack due to unrestricted resource allocation. This allows an attacker to exhaust system resources via HTTP requests. Recommendations Update Kron PA...
CVE-2025-34140
An authorization bypass vulnerability exists in ETQ Reliance legacy CG and NXG SaaS platforms. By appending a specific URI suffix to certain API endpoints, an unauthenticated attacker can bypass access control checks and retrieve limited sensitive resources. The root cause was a misconfiguration ...
Security Bulletin: IBM® Db2® is vulnerable to a denial of service under certain conditions. (CVE-2025-1493)
Summary IBM® Db2® is vulnerable to a denial of service due to concurrent execution of shared resources. Vulnerability Details CVEID:CVE-2025-1493 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server could allow an authenticated user to cause a denial of service due to...
Security Bulletin: IBM® Db2® federated server is vulnerable to a denial of service due to insufficient release of allocated memory resources. (CVE-2025-0915)
Summary IBM® Db2® is vulnerable to a denial of service due to insufficient release of allocated memory resources. Vulnerability Details CVEID:CVE-2025-0915 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server under specific configurations could allow an authenticated user ...
CVE-2025-41676
A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession...
CVE-2025-41677
A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession...
PT-2025-30523 · Unknown · Private-Ip
Name of the Vulnerable Software and Affected Versions: private-ip affected versions not specified Description: The package is susceptible to a Server-Side Request Forgery SSRF issue. An attacker can exploit this by providing an IP address or hostname that resolves to a multicast IP address...
WordPress Yogi Deserialization Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation, WordPress is a set of blogging platform developed using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL, and WordPress plugin is an application plugin. WordPress Yogi suffer...
The vulnerability of the Suricata intrusion detection and prevention system, due to the unlimited distribution of resources, allows an intruder to trigger a service failure.
The vulnerability of the Suricata intrusion detection and prevention system is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures...
CVE-2025-8036
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...
CVE-2025-34140
CVE-2025-34140 affects ETQ Reliance (CG/NXG platforms). An authorization bypass allows unauthenticated access to limited sensitive resources by appending a localized-text URI suffix to API endpoints. Root cause: misconfiguration in API authorization logic; fix implemented in SE.2025.1 and 2025.1....
CVE-2025-34140 ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix
An authorization bypass vulnerability exists in ETQ Reliance legacy CG and NXG SaaS platforms. By appending a specific URI suffix to certain API endpoints, an unauthenticated attacker can bypass access control checks and retrieve limited sensitive resources. The root cause was a misconfiguration ...
CVE-2025-34140 ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix
An authorization bypass vulnerability exists in ETQ Reliance legacy CG and NXG SaaS platforms. By appending a specific URI suffix to certain API endpoints, an unauthenticated attacker can bypass access control checks and retrieve limited sensitive resources. The root cause was a misconfiguration ...
PT-2025-30411 · Etq · Etq Reliance
Name of the Vulnerable Software and Affected Versions: ETQ Reliance versions prior to SE.2025.1 ETQ Reliance versions prior to 2025.1.2 Description: An authorization bypass allows an unauthenticated attacker to retrieve limited sensitive resources by appending a specific URI suffix to certain API...
ETQ Reliance CG 代码问题漏洞
ETQ Reliance CG is a quality management system from ETQ Corporation. A security vulnerability exists in ETQ Reliance CG that stems from the /resources/sessions/sso endpoint not disabling external entity parsing, which could lead to an XML external entity injection attack...
