CVE-2025-7329: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious user to view and modify sensitive data or make the webpage unavailable. The vulnerability stems from missing special character filtering and encoding. Successful exploitation...

CVE-2025-59285: Deserialization of Untrusted Data

Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

Photon OS 5.0: Linux PHSA-2025-5.0-0642

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0642. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-59295: Heap-based Buffer Overflow

Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network...

CVE-2025-41705: Unprotected Transport of Credentials

An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...

EUVD-2025-34042

A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a specially crafted junction, potentially leading to local privilege escalation. For more information, please refer to section 'Security Update for Armoury Crate...

CVE-2025-9968

CVE-2025-9968 affects the Armoury Crate product family, specifically the UnifyScanner component. A link following vulnerability can be triggered by crafting a junction, potentially allowing local privilege escalation. Impact is described as high for confidentiality and integrity with local attack...

CVE-2025-8915: Exposure of Sensitive Information to an Unauthorized Actor

Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network...

CVE-2025-27259: Improper Neutralization of Input During Web Page Generation

Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect victims to other sites or domains...

CVE-2025-9902: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co. Ltd. QRMenu allows Privilege Abuse. This issue affects QRMenu: from 1.05.12 before Version dated 05.09.2025...

CVE-2025-11184: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in QGIS QWC2 Registration GUI =v2025.03.31 allows an authorized attacker to plant arbitrary JavaScript code in the page...

CVE-2025-0636: Improper Neutralization of Special Elements used in an OS Command

EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Code Execution...

CVE-2025-9713: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required...

CVE-2025-6919: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Cats Information Technology Software Development Technologies Aykome License Tracking System allows SQL Injection. This issue affects Aykome License Tracking System: before Version dated 06.10.2025...

CVE-2025-62386: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database...

CVE-2025-62390: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database...

Exploit for Path Traversal in Carel Pcoweb_Card_Firmware

CVE-2022-37122 Path Traversal Scanner !Bannerhttps://raw.g...

CVE-2025-31992: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

HCL Unica MaxAI Assistant is susceptible to a HTML injection vulnerability. An attacker could insert special characters that are processed client-side in the context of the user's session...

CVE-2025-52616: Exposure of Sensitive System Information to an Unauthorized Control Sphere

HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application...

CVE-2025-58290: Improper Resolution of Path Equivalence

Denial of service DoS vulnerability in the office service. Successful exploitation of this vulnerability may affect availability...