CVE-2025-8021

All versions of the package files-bucket-server are vulnerable to Directory Traversal where an attacker can traverse the file system and access files outside of the intended directory...

SAMSUNG MagicINFO 9 Server 安全漏洞

SAMSUNG MagicINFO 9 Server is an enterprise-class digital signage content management and device monitoring platform from Samsung Korea. SAMSUNG MagicINFO 9 Server suffers from a path traversal vulnerability that stems from an improper restriction of restricted directory pathnames. An attacker cou...

The vulnerability of the Web Server component of the Oracle BI Publisher software, which is used for creating reports, allows a malicious individual to gain access to read, modify, add, or delete data.

The vulnerability of the Web Server component of the Oracle BI Publisher software for creating reports is related to lack of access control measures. Exploiting this vulnerability could allow an attacker to gain read, modify, add, or delete access to data...

SAMSUNG MagicINFO 9 Server 安全漏洞

SAMSUNG MagicINFO 9 Server is an enterprise-class digital signage content management and device monitoring platform from Samsung Korea. A file upload vulnerability exists in SAMSUNG MagicINFO 9 Server, which originates from allowing the upload of dangerous types of files and can be exploited by a...

CVE-2025-7371

Okta On-Premises Provisioning OPP agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You...

CVE-2025-51481

Local File Inclusion in dagster.grpc.impl.getnotebookdata in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebookpath field of ExternalNotebookData requests, bypassing the intended extension-based check...

Apache Jena allows users with administrator access to create databases files outside the files area of the Fuseki server

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue...

CVE-2025-41675 Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization

A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command...

CVE-2025-41675 Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization

A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command...

Vulnerability of the Server component: The MySQL Server database management system, which allows a hacker to cause service interruptions.

Vulnerability of the MySQL Server component: The DDL system for database management of MySQL Server is vulnerable to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Oracle MySQL Server 8.4.x < 8.4.5 (July 2025 CPU)

The versions of MySQL Server installed on the remote host are affected by a DoS vulnerability as referenced in the July 2025 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and...

Oracle MySQL Server 9.0.x < 9.3.0 (July 2025 CPU)

The versions of MySQL Server installed on the remote host are affected by a DoS vulnerability as referenced in the July 2025 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and...

Oracle MySQL Server 8.0.x < 8.0.42 (July 2025 CPU)

The versions of MySQL Server installed on the remote host are affected by a DoS vulnerability as referenced in the July 2025 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and...

CVE-2025-30750

Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 19.3-19.27, 21.3-21.18 and 23.4-23.8. Easily exploitable vulnerability allows high privileged attacker having Create User privilege with network access via Oracle Net to compromise...

CVE-2025-50073

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Container. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2025-29009

CVE-2025-29009 affects the WordPress plugin Medical Prescription Attachment Plugin for WooCommerce (versions n/a through 1.2.3). The issue is an Unrestricted Upload of File with Dangerous Type vulnerability in the plugin, enabling an unauthenticated attacker to upload a web shell to the web serve...

BIT-MARIADB-MIN-2025-30693

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

BIT-APACHE-2024-43394 Apache HTTP Server: SSRF on Windows due to UNC paths

Server-Side Request Forgery SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via modrewrite or apache expressions that pass unvalidated request input. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63. Note: The Apache HTTP Server...

CVE-2025-7359 Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block

The Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisitorgetblock function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2025-7359

CVE-2025-7359 — Counter live visitors for WooCommerce (WordPress) contains an unauthenticated arbitrary file deletion vulnerability in the wcvisitor_get_block function. Affected versions: all up to and including 1.3.6. The issue arises from insufficient file-path validation, allowing an attacker ...