EUVD-2019-4098

Malware in sbrugna...

EUVD-1999-1149

Malware in sbrugna...

CVE-2025-3718: Improper Limitation of a Pathname to a Restricted Directory

A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. An authenticated user with limited privileges can craft a malicious URL which, if visited by an authenticated victim, leads to a Cross-Site Scriptin...

CVE-2025-3719: Incorrect Authorization

An access control vulnerability was discovered in the CLI functionality due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited privileges can issue administrative CLI commands, altering the device configuration, and/o...

CVE-2025-40889: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authenticated user with limited privileges, by issuing a specifically-crafted request, can potentially alter the structure and content of files in the /data folder...

CVE-2025-40888: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data...

Photon OS 4.0: Open PHSA-2025-4.0-0878

An update of the open package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0878. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-40887: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data...

CVE-2025-40886: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SQL statements on the DBMS used by the web application, potentially exposing unauthorized data, altering...

CVE-2025-37728: Insufficiently Protected Credentials

Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access...

Exploit for Improper Access Control in Oracle Concurrent_Processing

Oracle E-Business Suite RCE Scanner CVE-2025-61882 A fast,...

CVE-2025-58591: Improper Limitation of a Pathname to a Restricted Directory

A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information...

CVE-2025-58587: Improper Restriction of Excessive Authentication Attempts

The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an attacker to guess user credentials...

CVE-2025-0606: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Logo Software Inc. Logo Cloud allows Forceful Browsing, Resource Leak Exposure. This issue affects Logo Cloud: before 0.67...

CVE-2025-58582: Allocation of Resources Without Limits or Throttling

If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged...

CVE-2025-58583: Exposure of Sensitive System Information to an Unauthorized Control Sphere

The application provides access to a login protected H2 database for caching purposes. The username is prefilled...

CVE-2025-58581: Exposure of Sensitive Information to an Unauthorized Actor

When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application...

CVE-2025-58579: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration...

CVE-2025-58585: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering...

CVE-2025-59728: Out-of-bounds Write

When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below 0, it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is...