21798 matches found
CVE-2025-3759
CVE-2025-3759 affects WF2220. The documented vulnerability is that the endpoint /cgi-bin-igd/netcore_set.cgi, used to change device configuration, is accessible without authentication due to a missing access control check. Root cause: lack of authentication enforcement on configuration changes. R...
CVE-2025-3758
CVE-2025-3758 affects WF2220. The issue is an exposed endpoint /cgi-bin-igd/netcore_get.cgi that returns device configuration to unauthorized users, including cleartext passwords. This is a direct confidentiality and integrity risk (per CVSS data: HIGH confidentiality/integrity, adjacent attack v...
PT-2025-20371 · Wf2220 · Wf2220
Name of the Vulnerable Software and Affected Versions: WF2220 version affected versions not specified Description: The issue concerns an exposed endpoint "/cgi-bin-igd/netcore get.cgi" that returns the device's configuration to unauthorized users, including a cleartext password. The vendor was...
A Weighted Byzantine Fault Tolerance Consensus Driven Trusted Multiple Large Language Models Network
Large Language Models LLMs have achieved remarkable success across a wide range of applications. However, individual LLMs often produce inconsistent, biased, or hallucinated outputs due to limitations in their training corpora and model architectures. Recently, collaborative frameworks such as th...
PT-2025-20372 · Netis Systems · Wf2220
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The endpoint /cgi-bin-igd/netcore set.cgi is used for changing device configuration and is accessible without authentication, posing a significant security threat. This could allow for...
ruby:3.0 security update
An update is available for module.rubygem-pg, rubygem-abrt, rubygem-pg, module.ruby, module.rubygem-abrt, ruby, rubygem-mysql2, module.rubygem-mysql2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
10,000 WordPress Sites Affected by Arbitrary File Read Vulnerability in Eventin WordPress Plugin
📢In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. On April 6th, 2025, we received a submission for an Arbitrary File Read...
USN-7490-3: libsoup vulnerabilities
USN-7490-1 fixed vulnerabilities in libsoup2.4. This update provides the corresponding updates for libsoup3. Original advisory details: Tan Wei Chong discovered that libsoup incorrectly handled memory when parsing HTTP request headers. An attacker could possibly use this issue to send a malicious...
State of ransomware in 2025
Global ransomware trends and numbers With the International Anti-Ransomware Day just around the corner on May 12, Kaspersky explores the ever-changing ransomware threat landscape and its implications for cybersecurity. According to Kaspersky Security Network data, the number of ransomware...
CVE-2025-27921
A reflected cross-site scripting XSS vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization o...
libplctag 缓冲区错误漏洞
libplctag is an open source C library for libplctag that provides a portable and simple API for accessing Allen-Bradley and Modbus PLC data over Ethernet. A buffer error vulnerability exists in libplctag versions 2.0 through 2.6.3, which stems from an out-of-bounds read in the unpackresponse...
CVE-2025-46573
passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done b...
CVE-2025-46736 Umbraco Makes User Enumeration Feasible Based on Timing of Login Response
Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. The issue is patched in versions 10.8.10 and 13.8.1. No known workarounds a...
CVE-2025-46736 Umbraco Makes User Enumeration Feasible Based on Timing of Login Response
Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. The issue is patched in versions 10.8.10 and 13.8.1. No known workarounds a...
Umbraco Makes User Enumeration Feasible Based on Timing of Login Response
Impact Based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. Patches Patched in 10.8.10 and 13.8.1. Workarounds None available...
GO-2025-3656 Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano
Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano...
Introducing The Cloud Hunting Games CTF: Test Your Cloud Incident Response Skills
Wiz is excited to announce “The Cloud Hunting Games”, a new hands-on Capture the Flag CTF challenge designed to test your cloud incident response skills...
Proactive threat hunting with Talos IR
At Cisco Talos, we understand that effective cybersecurity isn't just about responding to incidents -- it's about preventing them from happening in the first place. One of the most powerful ways we do this is through proactive threat hunting. Our Talos Incident Response Talos IR team works closel...
