CVE-2025-24331

The Single RAN baseband OAM service is intended to run as an unprivileged service. However, it initially starts with root privileges and assigns certain capabilities before dropping to an unprivileged level. The capabilities retained from the root period are considered extensive after the privile...

CVE-2024-9453

A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if th...

CVE-2025-30947 WordPress Cool fade popup plugin <= 10.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in gopiplus Cool fade popup cool-fade-popup allows Blind SQL Injection.This issue affects Cool fade popup: from n/a through = 10.1...

CVE-2024-9453 Jenkins-image: sensitive data disclosure when using openshift jenkins image

A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if th...

CVE-2024-9453

A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if th...

CVE-2025-5372 Libssh: incorrect return code handling in ssh_kdf() in libssh

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenl...

CVE-2025-5372 Libssh: incorrect return code handling in ssh_kdf() in libssh

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenl...

CVE-2025-5372

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenl...

PT-2025-28020

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6 Description: A problematic vulnerability was found in HDF5, affecting the function H5FS sinfo serialize node cb of the file src/H5FScache.c. This vulnerability leads to a heap-based buffer overflow. Local access is require...

PT-2025-27899 · Unknown · Otwthemes Content Manager Light

Name of the Vulnerable Software and Affected Versions: OTWthemes Content Manager Light versions n/a through 3.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This enables potentia...

PT-2025-27909 · WordPress · Pressroom - News Magazine Wordpress Theme

Name of the Vulnerable Software and Affected Versions: Pressroom - News Magazine WordPress Theme versions n/a through 6.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables...

CVE-2025-49601

In MbedTLS 3.3.0 before 3.6.4, mbedtlslmsimportpublickey does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a possible out-of-bounds read on truncated input. Specifically, an out-of-bounds read in mbedtlslmsimportpublickey allows context-dependent...

PT-2025-27927 · Unknown · The Beautiful Cookie Consent Banner

Name of the Vulnerable Software and Affected Versions: Nikel Beautiful Cookie Consent Banner versions through 4.6.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

CVE-2025-34082

A command injection vulnerability exists in IGEL OS versions prior to 11.04.270 within the Secure Terminal and Secure Shadow services. The flaw arises due to improper input sanitization in the handling of specially crafted PROXYCMD commands on TCP ports 30022 and 5900. An unauthenticated attacker...

CVE-2025-27461 CVE-2025-27461

During startup, the device automatically logs in the EPC2 Windows user without requesting a password...

CVE-2025-27457 CVE-2025-27457

All communication between the VNC server and clients is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data...

CVE-2025-27456 CVE-2025-27456

The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks...

CVE-2025-1711 CVE-2025-1711

Multiple services of the DUT as well as different scopes of the same service reuse the same credentials...

CVE-2025-1711

CVE-2025-1711 affects Endress+Hauser MEAC300-FNADE4. Descriptions across sources state that multiple services of the device under test reuse the same credentials across different scopes within the same service. Public details do not provide exploit paths or a confirmed fix version; NVD lists CVSS...

MAL-2025-5597 Malicious code in @figshare/old-viewers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b582af08f54b24b027eb8ffb5e56e63e4efff4c947ef2abb5fc552a7476539d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...