webkitgtk: Logic issue allowing access to restricted ports on arbitrary servers

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access restricted ports on arbitrary servers...

webkitgtk: Access to restricted ports on arbitrary servers via port redirection

A port redirection issue was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. A malicious website may be able to access restricted ports on arbitrary servers. The highest threat from this vulnerability is to data integrity...

PT-2025-28139 · Utt · Utt Hiper 840G

Name of the Vulnerable Software and Affected Versions: UTT HiPER 840G versions up to 3.1.1-190328 Description: A critical issue has been found in the processing of the file /goform/formPictureUrl. The manipulation of the importpictureurl argument leads to buffer overflow. This issue can be...

PT-2025-28095 · Boyuncms · Boyuncms

Name of the Vulnerable Software and Affected Versions: BoyunCMS versions up to 1.4.20 Description: A critical issue affects some unknown functionality of the file /application/user/controller/Index.php, where the manipulation of the image argument leads to unrestricted upload. This issue can be...

SUSE CVE-2025-3611

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team...

CVE-2025-28980

CVE-2025-28980 is a path traversal vulnerability in the WordPress plugin “Aviation Weather from NOAA” (versions

The vulnerability of Nokia’s Single Radio Access Network management platform lies in the improper limitation of the path name to the restricted access catalog. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Nokia Single RAN network management platform lies in the incorrect limitation of the path name when processing the PlanId parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected informati...

The vulnerability of Nokia’s Single Radio Access Network management platform lies in the improper limitation of the path name to the restricted access catalog. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Nokia Single RAN network management platform lies in the improper limitation of the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

CVE-2025-6943

Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables...

CVE-2025-6943

Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables...

CVE-2025-6943

Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables...

CVE-2025-6943

The CVE-2025-6943 entry relates to Delinea Secret Server (Thycotic Secret Server) versions 11.7 and earlier. A SQL report creation vulnerability arises from insufficient validation of SQL report creation, enabling an administrator to access restricted tables. The impact is limited to local/admin ...

CVE-2025-6943

Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables...

Delinea Secret Server 安全漏洞

Delinea Secret Server is a powerful PAM in the cloud or locally from Delinea USA. A security vulnerability exists in Delinea Secret Server version 11.7 and earlier, which stems from insufficient validation of SQL report creation and could lead to administrator access to restricted tables...

The vulnerability of the software deployment plugin and the GLPI Inventory network is related to incorrect restrictions on the path to the restricted-access catalog, allowing attackers to gain access to protected information.

The vulnerability of the software deployment and GLPI Inventory network component relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker to gain access to protected information...

The vulnerability of the IBM InfoSphere Information Server software platform’s data integration module lies in the incorrect limitation of the path name for the restricted access catalog, allowing attackers to read arbitrary files.

The vulnerability of the IBM InfoSphere Information Server software integration platform is related to incorrect restrictions on the path name to the restricted-access catalog. Exploiting this vulnerability allows a malicious actor to remotely read arbitrary files by sending a specially crafted...

PT-2025-26837 · Cvat · Cvat

Name of the Vulnerable Software and Affected Versions: CVAT versions 2.2.0 through 2.39.0 Description: CVAT is an open source interactive video and image annotation tool for computer vision. The issue arises from the lack of validation during the import process of a project or task backup, allowi...

PT-2025-26864 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06B01 Description: A critical vulnerability has been found in the D-Link DIR-619L, affecting the function formSetWAN Wizard51 of the file /goform/formSetWAN Wizard51. The manipulation of the argument curTime leads to...

The vulnerability of the processAttachmentDataStream function in the software for remote monitoring, management, and support of servers and data storage systems in HPE Insight Remote Support allows a attacker to execute arbitrary code.

The vulnerability of the processAttachmentDataStream function in the software for remote monitoring, management, and support of servers and data storage systems in HPE Insight Remote Support is related to an incorrect limitation on the path name to the restricted-access directory. Exploiting this...

The vulnerability of the WinRAR file archiver, related to incorrect restrictions on the path name of the restricted directory, allows a hacker to execute arbitrary code.

The vulnerability of the WinRAR file archiver is related to incorrect restrictions on the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code upon opening a specially crafted file...