1867 matches found
PT-2025-16498
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An unauthenticated attacker can obtain a list of smart devices by knowing a valid username through an unprotected API. Recommendations At the moment, there is no information about a newer...
The vulnerability of Adobe Experience Manager’s content and media data management system, which stems from the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.
The vulnerability of Adobe Experience Manager’s content and media data management system exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created link...
The vulnerability of the Clickstorm SEO (cs_seo) extension of the TYPO3 content management system, which exists due to the lack of measures taken to protect the structure of web pages, allows attackers to perform cross-site scripting attacks.
The vulnerability of the Clickstorm SEO csseo extension of the TYPO3 content management system exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
The vulnerability of the Apache Fineract digital financial services platform, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL code.
The vulnerability of the Apache Fineract digital financial services platform lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary SQL code...
CVE-2024-13604 KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin <= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive dat...
“Nudify” deepfakes stored unprotected online
Yesterday, we told you about how millions of pictures from specialized dating apps had been stored online without any kind of password protection. Now it's the turn of an AI "nudify" service. A researcher, famous for finding unprotected cloud storage buckets, has uncovered an unprotected AWS buck...
Jenkins plugin Templating Engine 代码注入漏洞
Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A code injection...
Intimate images from kink and LGBTQ+ dating apps left exposed online
A researcher found millions of pictures from specialized dating apps for iOS stored online without any kind of password protection. The pictures, some of which are explicit, stem from dating apps that all have a specific audience. The five platforms, all developed by M.A.D. Mobile are kink sites...
Ksenia Security Lares 4.0 Remote Code Execution
Ksenia Security Lares version 4.0 suffers from a remote code execution vulnerability. Exploit Title: Ksenia Security Lares 4.0 Home Automation Remote Code Execution Google Dork: N/A Date: 31 March 2025 Exploit Author: Mencha 'ShadeLock' Isajlovska Vendor Homepage: https://www.kseniasecurity.com/e...
The vulnerability of the GUI component of the FortiSandbox threat detection and mitigation system allows a perpetrator to execute arbitrary code or commands.
The vulnerability of the GUI component of the FortiSandbox threat detection and mitigation system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or commands using specially created HTTP...
CVE-2025-24263
A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15.4. An app may be able to observe unprotected user data...
CVE-2025-24263
A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15.4. An app may be able to observe unprotected user data...
Ksenia Security Lares WebServer Home Automation Remote Code Execution
Summary Lares is a burglar alarm & home automation system that can be controlled by means of an ergo LCD keyboard, as well as remotely by telephone, and even via the Internet through a built-in WEB server. Description The device provides access to an unprotected endpoint, enabling the upload of...
Apple macOS 安全漏洞
Apple macOS is a set of specialized operating systems developed for Mac computers by Apple, Inc. A security vulnerability exists in Apple macOS that stems from privacy concerns and could cause applications to observe unprotected user data...
The vulnerability of the dfe_body_copy component in the Virtuoso-OpenSource web application development platform allows a attacker to trigger a service failure.
The vulnerability of the dfebodycopy component in the Virtuoso-OpenSource web application development platform is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to cause service interruptions...
The vulnerability of the sqlgvec_upd component in the Virtuoso-OpenSource web application development platform allows a attacker to cause a service failure.
The vulnerability of the sqlgvecupd component in the Virtuoso-OpenSource web application development platform is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to cause service interruptions remotely...
The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from the lack of protective measures for website structures, allowing attackers to perform cross-site scripting attacks.
The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
CVE-2024-7598
A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies ...
GHSA-5V9M-57MQ-QC75 Open WebUI denial of service through endpoint for converting markdown
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until...
CVE-2024-7983 Denial of Service in open-webui/open-webui
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until...