91058 matches found
CVE-2025-58586: Observable Response Discrepancy
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one...
CVE-2025-59731: Out-of-bounds Write
When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rlerawsize from the input file at 0, we decompress and decode into the buffer td-rlerawdata of size rlerawsize a...
CVE-2025-0609: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Logo Software Inc. Logo Cloud allows Cross-Site Scripting XSS. This issue affects Logo Cloud: before 1.18...
CVE-2025-58589: Exposure of Sensitive Information to an Unauthorized Actor
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker thus receives information about the technology used and the structure of the application...
CVE-2025-58584: Use of GET Request Method With Sensitive Query Strings
In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally...
CVE-2025-9914: Authentication Bypass Using an Alternate Path or Channel
The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application...
CVE-2025-58590: Improper Limitation of a Pathname to a Restricted Directory
It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information...
CVE-2025-59732: Out-of-bounds Write
When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy loops at 0 and 1 will continue to write until the next multiple of 8. The buffer...
CVE-2025-0606: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in Logo Software Inc. Logo Cloud allows Forceful Browsing, Resource Leak Exposure. This issue affects Logo Cloud: before 0.67...
CVE-2025-59728: Out-of-bounds Write
When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call xmlNodeGetContent below 0, it returns a buffer precisely allocated to match the string length, using strdup internally. If this buffer is...
CVE-2025-58579: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration...
CVE-2025-58591: Improper Limitation of a Pathname to a Restricted Directory
A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information...
CVE-2025-58587: Improper Restriction of Excessive Authentication Attempts
The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an attacker to guess user credentials...
CVE-2025-58578: Allocation of Resources Without Limits or Throttling
A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation...
Yaml-cpp Heap Buffer Overflow DoS
The vulnerability of the Token&Scanner::peek function in the scanner.cpp component of the YAML handling library for C++ Yaml-cpp is related to the insufficient use of the assert function. Exploiting this vulnerability may allow a remote attacker to cause a service failure...
CVE-2025-0608: URL Redirection to Untrusted Site
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Logo Software Inc. Logo Cloud allows Phishing, Forceful Browsing. This issue affects Logo Cloud: before 2025.R6...
CVE-2023-53588: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check for station first in client probe When probing a client, first check if we have it, and then check for the channel context, otherwise you can trigger the warning there easily by probing when the AP isn't eve...
Photon OS 4.0: Linux PHSA-2025-4.0-0881
An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0881. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
