PT-2025-3923 · Unknown · Multivendorx

Name of the Vulnerable Software and Affected Versions: MultiVendorX plugin versions up to 4.2.14 Description: The issue allows unauthenticated attackers to include PHP files on the server via the tabname parameter, enabling the execution of any PHP code in those files. This can be used to bypass...

Advisory ROSA-SA-2025-2634

Software: OpenImageIO 2.2.20.0 OS: ROSA-CHROME packageevrstring: OpenImageIO-2.2.20.0-6 CVE-ID: CVE-2023-36183 BDU-ID: 2023-07656 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the readimg function of the OpenImageIO image processing library involves buffer copying without input validation...

CVE-2024-48310

The CVE-2024-48310 entry concerns AutoLib Software Systems OPAC v20.10, where multiple API keys are exposed in the source code (e.g., main.js) allowing potentially unauthorized access to the backend API or other sensitive information. Affected component: API keys embedded in the codebase; exploit...

CVE-2025-24101

This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3. An app may be able to access user-sensitive data...

CVE-2024-54549

This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data...

CVE-2025-24109

CVE-2025-24109 relates to a downgrade issue that was addressed by adding code-signing restrictions. The NVD entry states the issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, and macOS Sonoma 14.7.3, with the impact described as an app potentially accessing sensitive user data. Affected...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed for Mac computers by Apple, Inc. A security vulnerability exists in Apple macOS version 15.2, which stems from an application that may be able to access sensitive user data...

PT-2025-3369 · Govee · Govee Home

Name of the Vulnerable Software and Affected Versions: Govee Home iOS version 6.5.01 Description: The issue allows attackers to access sensitive user information via supplying a crafted payload. Recommendations: For Govee Home iOS version 6.5.01, at the moment, there is no information about a new...

CVE-2024-56950

CVE-2024-56950 affects KuGou Concept for iOS (version 4.0.61). The issue allows attackers to access sensitive user information by sending a crafted link. Public details describe the vulnerability mechanism as a crafted link but do not include explicit exploit code or practical exploit steps. Some...

Apple macOS 竞争条件问题漏洞

Apple macOS is a suite of specialized operating systems developed by Apple Inc. for Mac computers. A competitive condition issue vulnerability exists in Apple macOS version 15.3, which arises from an application that may be able to access sensitive user data...

CVE-2024-11090

CVE-2024-11090 affects the WordPress plugin “Membership Plugin – Restrict Content” (WordPress). Exposed versions: all up to and including 3.2.13. Root cause: the WordPress core search feature does not properly restrict access, allowing unauthenticated users to read restricted content. Impact: sen...

Fedora Repository fedoraIntCallUser default credentials and insecure archive extraction

RISK EVALUATION Fedora Repository 3.8 includes default user credentials and allows path traversal when extracting uploaded archive files. An attacker can exploit these vulnerabilities to read sensitive data and execute arbitrary commands with the privileges of the Java web application server...

CVE-2025-0428

The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form'postcontent' variable through the wpaicgexportprompts function. This allows authenticated attackers, with...

CVE-2025-21511

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime SEC. Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...

WeGIA SQL注入漏洞

WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A SQL injection vulnerability exists in WeGIA versions prior to 3.2.9. An attacker can exploit this vulnerability to execute arbitrary SQL commands in the database to access sensitive information...

WeGIA SQL注入漏洞

WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A SQL injection vulnerability exists in WeGIA versions prior to 3.2.9. An attacker can exploit this vulnerability to execute arbitrary SQL commands in the database to access sensitive information...

macOS 12.x < 12.7.5 Multiple Vulnerabilities (120899)

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.7.5. It is, therefore, affected by multiple vulnerabilities: - A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to elevate privileges. CVE-2024-27843 -...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in Windows. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: - Denial of Service DoS - Circumvention of security measure - Execution of arbitrary code User Rights - Execution of arbitrar...

Advisory ROSA-SA-2025-2555

Software: cups 1.6.3 OS: rosa-server79 packageevrstring: cups-1.6.3-52.res7 CVE-ID: CVE-2023-32360 BDU-ID: 2023-07653 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the CUPS print server is related to flaws in the authentication procedure. Exploitation of the vulnerability could allow an attacker...

SAP BusinessObjects Business Intelligence Platform 安全漏洞

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. An information disclosure vulnerability exists in SAP BusinessObjects Business Intelligence Platform, which can be exploited by an attacker to hijack a session, access and modify sensitive data ...