CVE-2025-4230

CVE-2025-4230 – PAN-OS command injection via CLI : Multiple connected sources confirm a vulnerability in Palo Alto Networks PAN-OS software where an authenticated administrator with PAN-OS CLI access can bypass restrictions and execute arbitrary root commands. The issue is a local attack with hig...

CVE-2025-3473

Summary: CVE-2025-3473 affects IBM Guardium Data Protection (11.5 and 12.1). A local privileged user can escalate to root due to insecure inherited permissions created by the program (CWE-277). The base CVSS v3.1 score is 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). IBM’s security bulletin confirms...

CVE-2025-4128 Mattermost Guest User Information Disclosure Vulnerability

Mattermost versions 10.5.x = 10.5.4, 9.11.x = 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/teamid...

CVE-2025-4128

CVE-2025-4128 affects Mattermost server: vulnerable products are Mattermost versions 10.5.x (up to 10.5.4) and 9.11.x (up to 9.11.13). The issue is an improper access restriction that allows guest users to bypass permissions and view information about public teams they are not members of via dire...

CVE-2025-4128 Mattermost Guest User Information Disclosure Vulnerability

Mattermost versions 10.5.x = 10.5.4, 9.11.x = 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/teamid...

IBM Security Guardium Information Disclosure Vulnerability (CNVD-2025-12296)

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. IBM Security Guardium has an information disclosure...

CVE-2025-47849

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and...

CVE-2025-24471

An Improper Certificate Validation vulnerability CWE-295 in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate...

CVE-2025-25250

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability CWE-200 vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow an authenticated user to access full...

CVE-2025-24471

An Improper Certificate Validation vulnerability CWE-295 in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate...

BIT-MARIADB-MIN-2020-28912

With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between...

CVE-2025-5742

CWE-79: Improper Neutralization of Input During Web Page Generation ‘Cross-site Scripting’ vulnerability exists when an authenticated user modifies configuration parameters on the web server...

CVE-2025-42982

SAP GRC allows a non-administrative user to access and initiate transaction which could allow them to modify or control the transmitted system credentials. This causes high impact on confidentiality, integrity and availability of the application...

PT-2025-24892 · Redcap · Redcap

Name of the Vulnerable Software and Affected Versions: REDCap versions 13.1.9 Description: A stored cross-site scripting XSS issue in the Project Dashboards allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the Dashboard title and Dashboard...

CVE-2025-22481

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

CVE-2025-22486

An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system. We have already fixed the vulnerability in the following versions: File...

CVE-2025-29884 File Station 5

An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system. We have already fixed the vulnerability in the following versions: File...

CVE-2025-29892 Qsync Central

An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.6...

CVE-2024-50406 License Center

A cross-site scripting XSS vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version:...

CVE-2025-22481

CVE-2025-22481 is a remote command injection vulnerability affecting QNAP QTS and QuTS Hero. The issue is identified as improper neutralization of special elements used in a command, enabling remote attackers with user access to execute arbitrary commands. Affected products include QTS and QuTS H...