CVE-2025-49457

CVE-2025-49457 affects Zoom Clients for Windows (multiple Zoom products: Zoom Workplace for Windows, Zoom Rooms for Windows, Zoom Rooms Controller, Zoom Meeting SDK for Windows) where an untrusted search path could allow an unauthenticated attacker to escalate privileges over the network. Affecte...

CVE-2025-20625

Improper conditions check for some IntelR PROSet/Wireless WiFi Software for Windows before version 23.110.0.5 may allow an unauthenticated user to potentially enable denial of service via adjacent access...

PT-2025-32947

Name of the Vulnerable Software and Affected Versions: Zoom Clients for Windows affected versions not specified Description: A race condition exists in the installer for certain Zoom Clients for Windows. This may allow a local, unauthenticated user to compromise application integrity...

CVE-2025-52897

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

CVE-2025-52897

GLPI planning feature vulnerability: versions 9.1.0–10.0.18 allow unauthenticated users to send a malicious link to conduct phishing. Root cause described in multiple sources as inadequate filtering/handling of links within the planning module (with some references labeling it as XSS and open red...

PT-2025-31385 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions 9.1.0 through 10.0.18 Description: GLPI is an Asset and IT Management Software package. An unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. Recommendations: Update to version...

CVE-2025-36010

IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 could allow an unauthenticated user to cause a denial of service due to executable segments that are waiting for each other to release a necessary lock...

CVE-2025-36010

IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 could allow an unauthenticated user to cause a denial of service due to executable segments that are waiting for each other to release a necessary lock...

CVE-2025-36010 IBM Db2 for Linux denial of service

IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 could allow an unauthenticated user to cause a denial of service due to executable segments that are waiting for each other to release a necessary lock...

CVE-2025-36010 IBM Db2 for Linux denial of service

IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 could allow an unauthenticated user to cause a denial of service due to executable segments that are waiting for each other to release a necessary lock...

Palantir secure-upload 授权问题漏洞

Palantir secure-upload is an upload component from Palantir USA. A security vulnerability exists in Palantir secure-upload versions prior to 0.815.0 that stems from a privileged user potentially abusing the endpoint redirection submission channel and an unauthenticated user potentially enumeratin...

CVE-2025-3498

An unauthenticated user with management network access can get and modify the Radiflow iSAP Smart Collector CentOS 7 - VSAP 1.20 configuration. The device has two web servers that expose unauthenticated REST APIs on the management network TCP ports 8084 and 8086. An attacker can use these APIs to...

microcode_ctl: From CVEorg collector

Incorrect behavior order for some IntelR Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclosure via physical access...

microcode_ctl: From CVEorg collector

Incorrect behavior order for some IntelR Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclosure via physical access...

CVE-2025-5015

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one...

CVE-2025-5015

CVE-2025-5015 : A cross-site scripting vulnerability exists in the Parsons AccuWeather widget and the Custom RSS widget, allowing an unauthenticated user to replace the RSS feed URL with a malicious one. Concrete details across sources confirm the affected components, the attack involves injectin...

CVE-2025-5015 Parsons AccuWeather Widget Cross-site Scripting

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one...

VulnCheck KEV: CVE-2024-0692

The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution...

WordPress WP-DownloadCounter plugin <= 1.01 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WP-DownloadCounter versions = 1.01...

CVE-2025-5740

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause arbitrary file writes when an authenticated user on the web server manipulates file path...