AZL-61736 CVE-2025-4207 affecting package postgresql for versions less than 16.9-1

Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13,...

PT-2025-20440 · D Link · D-Link Dir-605L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L version 2.13B01 Description: A critical issue affects the function sub 454F2C, where the manipulation of the argument sysCmd leads to command injection. The attack may be initiated remotely. This issue only affects products th...

PT-2025-20448 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.04B04 Description: A critical issue was found in the formEasySetupWizard function, where the manipulation of the curTime argument leads to a buffer overflow. This issue can be exploited remotely. The vendor was...

PT-2025-20449 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.04B04 Description: A critical issue has been found in the function formEasySetupWizard3, where the manipulation of the argument wan connected leads to a buffer overflow. This issue can be exploited remotely. The vend...

Citrix Profile Management: Temporary Profile Loading and Profile details not visible in Director

Temporary Profile Loading and Profile details not visible in Director...

CVE-2024-42213

HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. An attacker might gain access to these files by indexing or retrieved via predictable URLs or misconfigured permissions, leading to information disclosure...

Insecure Randomness

Formidable is vulnerable to Insecure Randomness. The vulnerability is due to weak randomness due to the use of the non-cryptographically secure hexoid module for generating temporary filenames for untrusted content...

thunderbird: Information Disclosure of /tmp directory listing

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edit...

thunderbird: Information Disclosure of /tmp directory listing

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edit...

PT-2025-20285 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions up to and including 3.3.0 Description: An unauthenticated SQL Injection issue was identified in the endpoint "/html/socio/sistema/get socios.php", specifically in the query parameter. This allows attackers to inject and execute...

PT-2025-19910 · Unknown · Cardealerpress

Name of the Vulnerable Software and Affected Versions: CarDealerPress versions up to, and including, 6.7.2504.00 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level...

PT-2025-20295 · Unknown · Wagtail Cms

Name of the Vulnerable Software and Affected Versions: Wagtail CMS version 6.4.1 Description: The issue is related to a Stored Cross-Site Scripting XSS in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface...

PT-2025-20284 · Discourse · Discourse Code Review Plugin

Name of the Vulnerable Software and Affected Versions: Discourse Code Review Plugin versions prior to commit eed3a80 Description: The issue allows an attacker to execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This is a problem with the Discourse Code...

Do Not Allow Empty Links

Empty links are redundant files and waste system resources. In addition, if a file is installed or created at the target location of an empty link, the file can be accessed through the link, leading to possible information leakage or tampering. If the file to which the link points has been delete...

thunderbird: Information Disclosure of /tmp directory listing

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edit...

thunderbird: Information Disclosure of /tmp directory listing

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edit...

PT-2025-19934 · D Link · D-Link Dir-600

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600L versions up to 2.07B01 Description: A critical issue was found in the formLogin function, where manipulation of the host argument leads to a buffer overflow. This can be initiated remotely. The issue only affects products that...

PT-2025-19985 · Goshs · Goshs

Name of the Vulnerable Software and Affected Versions: goshs versions 0.3.4 through 1.0.4 Description: The issue allows anyone to execute commands on the server when goshs is run without arguments. This is due to the dispatchReadPump function not checking the -c option, allowing arbitrary command...

PT-2025-19946 · Tenda · Tenda Rx3

Name of the Vulnerable Software and Affected Versions: Tenda RX3 version 16.03.13.11 multi Description: A critical issue affects the processing of the file /goform/telnet, leading to command injection. The attack may be initiated remotely. Recommendations: For Tenda RX3 version 16.03.13.11 multi,...

PT-2025-19940 · D Link · D-Link Dir-600

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600L versions up to 2.07B01 Description: A critical vulnerability was found in the wake on lan function, allowing for command injection through the manipulation of the host argument. This issue can be exploited remotely and only...