22834 matches found
CVE-2025-2529
Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from malicious external parties in an unfiltered/unsalted way...
CVE-2024-48891
An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 in FortiSOAR 7.6.0 through 7.6.1, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an attacker who has already obtained a non-login low privileged shell access via...
CVE-2025-2529
Summary of CVE-2025-2529 (IBM Terracotta Ehcache 3.x) IBM Terracotta’s Ehcache 3.x library was found to be vulnerable to a hash-flooding DoS when applications use cache keys sourced from external/untrusted parties without filtration or salting. The public-facing description from IBM identifies de...
CVE-2025-10486
The CVE-2025-10486 entry concerns the WordPress Content Writer plugin. Publicly exposed log files allowed unauthenticated attackers to view sensitive information from all versions up to and including 3.6.8. The issue is categorized as unauthenticated information disclosure with a Network attack v...
CVE-2025-10303 Library Management System <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Manipulation
The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7librarymanagementajaxhandler function in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with...
CVE-2025-10038
CVE-2025-10038 describes an unauthenticated privilege-escalation in the WordPress plugin Binary MLM Plan (versions up to and including 3.0). The root cause is that the bmp_user role grants the manage_bmp capability by default when users register through the plugin’s form, enabling attackers to re...
CVE-2025-26861
RemoteCall Remote Support Program for Operator versions prior to 5.3.0 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution...
CVE-2025-55080 Improper Parameter Check in ThreadX Syscall Implementation
In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough, allowing an attacker to obtain an arbitrary memory read/write...
CVE-2025-55079
In Eclipse ThreadX before version 6.4.3, the thread module has a setting of maximum priority. In some cases the check of that maximum priority wasn't performed, allowing, as a result, to obtain a thread with higher priority than expected and causing a possible denial of service...
CVE-2025-55079
CVE-2025-55079 refers to Eclipse ThreadX RTOS prior to 6.4.3, where the thread module’s maximum priority check could be bypassed, allowing a thread to run at a higher priority than intended and cause a potential denial of service. This is corroborated by Red Hat and other industry sources in the ...
CVE-2025-55079 Missing check for thread priority
In Eclipse ThreadX before version 6.4.3, the thread module has a setting of maximum priority. In some cases the check of that maximum priority wasn't performed, allowing, as a result, to obtain a thread with higher priority than expected and causing a possible denial of service...
CVE-2025-61804 Animate | Heap-based Buffer Overflow (CWE-122)
Animate versions 23.0.13, 24.0.10 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
Amazon Linux 2 : sox, --advisory ALAS2-2025-3032 (ALAS-2025-3032)
The version of sox installed on the remote host is prior to 14.4.1-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3032 advisory. A floating point exception divide-by-zero issue was discovered in SoX in functon startread of wav.c file. An attacker with a crafted w...
Fedora 43 : mirrorlist-server / rust-maxminddb / rust-monitord-exporter / etc (2025-9e77f6ddcb)
The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-9e77f6ddcb advisory. - Update mirrorlist-server to version 3.0.8. - Update the maxminddb crate to version 0.26.0. - Update the prometheus crate to version 0.14.0. - Update the...
Oct8ne Chatbot 跨站脚本漏洞
Oct8ne Chatbot is a chatbot from Oct8ne. A cross-site scripting vulnerability exists in Oct8ne Chatbot version v2.3, which stems from stored cross-site scripting and could lead to an attacker executing JavaScript code in the victim's browser...
PT-2025-42381
Name of the Vulnerable Software and Affected Versions Cisco Snort 3 affected versions not specified Description A flaw exists in the Snort 3 HTTP Decoder that may allow a remote attacker to disclose sensitive data or cause the Snort 3 Detection Engine to crash. This issue stems from an error in...
PT-2025-42219
Name of the Vulnerable Software and Affected Versions SmartBI versions 8 through 10 Description SmartBI versions 8, 9, and 10 have an unrestricted file upload issue in the RMIServlet request handling logic. Attackers can send crafted requests to perform sensitive operations or execute code on the...
PT-2025-42382
Name of the Vulnerable Software and Affected Versions Cisco Snort 3 affected versions not specified Description A flaw exists in the Snort 3 HTTP Decoder that may allow a remote, unauthenticated attacker to disrupt service. The issue stems from insufficient error checking during the parsing of HT...
Multiple Cisco Products Snort 3 MIME DoS Vulnerabilities (cisco-sa-snort3-mime-vulns-tTL8PgVH_CVE-2025-20359)
According to its self-reported version, Cisco ASA Software is affected by a vulnerability. - Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the disclosure of possible sensitive data or cause the Sno...
