CVE-2025-6105

A vulnerability has been found in jflyfox jfinalcms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2025-6104 Wifi-soft UniBox Controller pms_check.php os command injection

A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/pmscheck.php. The manipulation of the argument ipaddress leads to os command injection. It is possible to initiate the attack remotely. The...

CVE-2025-6104

CVE-2025-6104 affects Wifi-soft UniBox Controller up to 20250506. The vulnerability is an OS command injection in the /billing/pms_check.php handling of the ipaddress argument. It can be triggered remotely, with exploit details publicly disclosed. Remediation guidance in PT-2025-25515 suggests re...

CVE-2025-6098

A vulnerability was found in UTT 进取 750W up to 5.0. It has been classified as critical. This affects the function strcpy of the file /goform/setSysAdm of the component API. The manipulation of the argument passwd1 leads to buffer overflow. It is possible to initiate the attack remotely. The explo...

CVE-2025-6097 UTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password change

A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/setSysAdm of the component Administrator Password Handler. The manipulation of the argument passwd1 leads to unverified password change. T...

TencentOS Server 4: python-twisted (TSSA-2024:1067)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1067 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

TencentOS Server 3: httpd (TSSA-2023:0026)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0026 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 3: httpd:2.4 (TSSA-2023:0215)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0215 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

PT-2025-25594 · Unknown · Intera Inhire

Name of the Vulnerable Software and Affected Versions: Intera InHire up to 20250530 Description: A critical vulnerability was found in Intera InHire, affecting an unknown functionality. The manipulation of the argument 29chcotoo9 leads to server-side request forgery. The attack can be launched...

TencentOS Server 3: ruby:3.0 (TSSA-2024:0234)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0234 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2025-6096

The CVE-2025-6096 entry concerns codesiddhant Jasmin Ransomware up to version 1.0.1. The vulnerability affects an unknown function in /dashboard.php where manipulating the Search argument leads to SQL injection. It is exploitable remotely, and publicly disclosed exploits exist. Connected document...

CVE-2025-6092

A vulnerability was found in comfyanonymous comfyui up to 0.3.39. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /upload/image of the component Incomplete Fix CVE-2024-10099. The manipulation of the argument image leads to cross site...

CVE-2025-6091 H3C GR-3000AX aspForm UpdateIpv6Params buffer overflow

A vulnerability was found in H3C GR-3000AX V100R007L50. It has been classified as critical. Affected is the function UpdateWanParamsMulti/UpdateIpv6Params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to launch the attack...

CVE-2025-22854

Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions...

CVE-2025-22854 Possible thread exhaustion from processing http responses in PingFederate Google Adapter

Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions...

CVE-2025-6089

A vulnerability has been found in Astun Technology iShare Maps 5.4.0 and classified as problematic. This vulnerability affects unknown code of the file atCheckJS.aspx. The manipulation of the argument ref leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed...

Locally Differentially Private Frequency Estimation Via Joint Randomized Response

Local Differential Privacy LDP has been widely recognized as a powerful tool for providing a strong theoretical guarantee of data privacy to data contributors against an untrusted data collector. Under a typical LDP scheme, each data contributor independently randomly perturbs their data before...

CVE-2025-24919 Dell ControlVault3/ControlVault3 Plus deserialization of untrusted input vulnerability

A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can...

HTTP Response Splitting

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to HTTP Response Splitting via the...

Cyber resilience begins before the crisis

In this blog you will hear directly from Microsoft’s Deputy Chief Information Security Officer CISO for Customer Security, Ann Johnson, about the need for proactive planning in cyber incidents, particularly surrounding communications. This blog is part of a new, ongoing series where our Deputy...