CVE-2025-34140 ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix

An authorization bypass vulnerability exists in ETQ Reliance legacy CG and NXG SaaS platforms. By appending a specific URI suffix to certain API endpoints, an unauthenticated attacker can bypass access control checks and retrieve limited sensitive resources. The root cause was a misconfiguration ...

PT-2025-30411 · Etq · Etq Reliance

Name of the Vulnerable Software and Affected Versions: ETQ Reliance versions prior to SE.2025.1 ETQ Reliance versions prior to 2025.1.2 Description: An authorization bypass allows an unauthenticated attacker to retrieve limited sensitive resources by appending a specific URI suffix to certain API...

ETQ Reliance CG 代码问题漏洞

ETQ Reliance CG is a quality management system from ETQ Corporation. A security vulnerability exists in ETQ Reliance CG that stems from the /resources/sessions/sso endpoint not disabling external entity parsing, which could lead to an XML external entity injection attack...

PT-2025-30404 · Undefined · Undefined

CVE-2025-54356 Rejected reason https://t.co/wlhPkGwe6f Don't wait vulnerability scanning results: https://t.co/oh1APvMMnd...

CVE-2025-41677

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession...

CVE-2025-41676

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession...

PT-2025-30253 · Fast · Fast

Name of the Vulnerable Software and Affected Versions: versions prior to 2025-41677 Description: A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession. Recommendations: At the moment, there ...

The vulnerability of Juniper Networks’ Junos OS lies in the improper assignment of permissions to critical resources, allowing attackers to increase their privileges.

The vulnerability of Juniper Networks’ Junos OS is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow attackers to increase their privileges...

PT-2025-30252 · Sendsms · Sendsms

Name of the Vulnerable Software and Affected Versions: versions prior to 2025-41676 Description: A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession. Recommendations: At the moment, there i...

PT-2025-30258 · Apache +1 · Apache Jena +1

Name of the Vulnerable Software and Affected Versions: Apache Jena versions up to 5.4.0 Description: The application does not validate file access paths within configuration files uploaded by users possessing administrator privileges. This could allow for unauthorized access or manipulation of...

Vulnerability of the Server component: The Optimizer component of the MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the MySQL Server component of the database management system involves the distribution of resources without any restrictions or controls. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

The vulnerability of HashiCorp’s Vault and Vault Enterprise storage platforms, which involve improper configuration of permissions for critical resources, allows attackers to bypass authentication processes.

The vulnerability of the HashiCorp Vault and Vault Enterprise archiving platforms relates to the improper assignment of permissions for critical resources. Exploiting this vulnerability could allow a malicious actor to bypass authentication processes...

CVE-2025-36097 IBM WebSphere Application Server denial of service

IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stack-based overflow. An attacker can send a specially crafted request that cause the server to consume excessive memory resources...

CVE-2025-36097 IBM WebSphere Application Server denial of service

IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stack-based overflow. An attacker can send a specially crafted request that cause the server to consume excessive memory resources...

CVE-2025-36097

CVE-2025-36097 affects IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7. The issue is a stack-based overflow in the server when processing specially crafted requests, leading to denial of service by consuming memory resources. The vulnerabili...

Improper Access Control

org.apache.zeppelin, zeppelin-server, interpreter is vulnerable to Improper Access Control. The vulnerability is due to the raft server protocol being accessible without authentication, which allows an attacker to view server resources including directories and files...

The vulnerability in the virtual controller OHCI USB programming interface of Oracle VM VirtualBox allows a attacker to escalate their privileges and execute arbitrary code.

The vulnerability of the virtual controller OHCI USB programming interface in Oracle VM VirtualBox is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain increased privileges and execute arbitrary code...

The vulnerability of BitLocker’s data protection function in the Microsoft Windows operating system allows attackers to circumvent existing security restrictions.

The vulnerability of BitLocker’s data protection function in the Microsoft Windows operating system is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions...

The vulnerability of the ath11k_core_halt() function in the drivers/net/wireless/ath/ath11k/core.c kernel module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ath11kcorehalt function in the drivers/net/wireless/ath/ath11k/core.c kernel module of the Linux operating system is related to damage to a node in the arvifs list due to incorrect initialization of resources. Exploiting this vulnerability can allow an attacker to cause a...

Vulnerability of Windows operating systems, related to synchronization errors when using shared resources, allows attackers to escalate their privileges.

The vulnerability of Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges...