PT-2025-1660 · Vmware · Horizon Client For Mac

Name of the Vulnerable Software and Affected Versions: Omnissa Horizon Client for macOS affected versions not specified Description: The issue is due to a logic flaw, allowing attackers with user privileges to escalate their privileges to root on the system where the Horizon Client for macOS is...

PT-2025-2364 · NetGear · Netgear Fvs336Gv3 +1

Name of the Vulnerable Software and Affected Versions: Netgear FVS336Gv2 affected versions not specified Netgear FVS336Gv3 affected versions not specified Description: The issue concerns a command injection vulnerability in the Telnet interface. An authenticated and remote attacker can execute...

PT-2025-3004

Name of the Vulnerable Software and Affected Versions NRadio N8-180 NROS version 1.9.2.n3.c5 Description A problem was discovered in NRadio devices, where the "/cgi-bin/luci/nradio/basic/radio" endpoint is vulnerable to command injection through the 2.4 GHz and 5 GHz name parameters. This allows ...

CVE-2025-24891

CVE-2025-24891 concerns Dumb Drop, a file upload application with a path traversal vulnerability that allows an attacker with upload permissions to overwrite arbitrary system files. The underlying issue is a path traversal flaw that can target files the container runs as root, enabling potentiall...

CVE-2025-24891 Dumb Drop has an arbitrary file overwrite and path traversal for root shell

Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrary system files. As the container runs as root by default, there is no limit to what can be overwritten. With this, it's possible to inject...

CVE-2025-24891 Dumb Drop has an arbitrary file overwrite and path traversal for root shell

Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrary system files. As the container runs as root by default, there is no limit to what can be overwritten. With this, it's possible to inject...

PT-2025-5594 · Dumb Drop · Dumb Drop

Name of the Vulnerable Software and Affected Versions: Dumb Drop affected versions not specified Description: The issue concerns a path traversal vulnerability in the Dumb Drop file upload application. Users with permission to upload to the service can exploit this vulnerability to overwrite...

CVE-2024-23971 ChargePoint Home Flex OCPP bswitch Command Injection

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from...

CVE-2021-3978

When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service this could allow for a vector, when...

DTEX DEC-M 安全漏洞

DTEX DEC-M is a unified internal risk management platform from DTEX Corporation. A security vulnerability exists in DTEX DEC-M version 6.1.1, which stems from a lack of proper logical validation, and allows an attacker to elevate privileges to root via an unauthorized client connection using the...

Edimax BR-6476AC 安全漏洞

Edimax BR-6476AC is a dual-band router from China Xunzhou Edimax. A security vulnerability exists in Edimax BR-6476AC version 1.06, which stems from a command injection issue that allows an attacker to execute arbitrary shell commands with root privileges...

PT-2025-4595 · Coolify · Coolify

Name of the Vulnerable Software and Affected Versions: Coolify versions prior to 4.0.0-beta.361 Description: The issue allows any authenticated user to attach any existing private key on a Coolify instance to their own server. If the server configuration of IP/domain, port, and user matches with...

dde-api-proxy 安全漏洞

dde-api-proxy is a proxy program from Deepin open source. A security vulnerability exists in dde-api-proxy version 1.0.19, which stems from the fact that an unprivileged user can access the D-Bus service as root...

WAVLINK AC3000 Static Login Vulnerability

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. The WAVLINK AC3000 suffers from a static login vulnerability that can be exploited by attackers to cause root access via specially crafted network packets...

Unspecified Vulnerability in D-Link DWR-M972V

The D-Link DWR-M972V is a router from China-based AUO D-Link. A security vulnerability exists in the D-Link DWR-M972V version 1.05SSG, which can be exploited by remote attackers to execute arbitrary code via SSH using the root account without restriction...

CVE-2025-22968

An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions...

CVE-2025-22968

An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions...

SUSE CVE-2025-23222

An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus servic...

CVE-2024-39754

A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to root access. An attacker can send packets to trigger this vulnerability...

CVE-2024-39754

A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to root access. An attacker can send packets to trigger this vulnerability...