2461 matches found
K000152607: Go vulnerability CVE-2023-39323
Security Advisory Description Line directives "//line" can be used to bypass the restrictions on "//go:cgo" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive...
CVE-2025-48339
CVE-2025-48339 concerns the WordPress plugin Profiler – What Slowing Down Your WP, with a Missing Authorization (Broken Access Control) vulnerability. Affected versions are n/a through 1.0.0. Root cause is incorrectly configured access control security levels leading to unauthorized access. The C...
BIT-MYSQL-CLIENT-2025-30722
Vulnerability in the MySQL Client product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise...
CVE-2025-52689 Weak Session ID Check in the OmniAccess Stellar Web Management Interface
Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privileges by spoofing the login request, potentially allowing the attacker to modify the behaviour of the access point...
CVE-2025-52687
The CVE-2025-52687 issue applies to Alcatel-Lucent OmniAccess Stellar products (Web Management Interface). Affected component: web management payload handling. Root cause described in sources as ability for an attacker with administrator credentials on the access point to inject malicious JavaScr...
CVE-2025-53842
Use of hard-coded credentials issue exists in ZWX-2000CSW2-HN prior to 0.3.19 and ZWX-2000CS2-HN firmware all versions. If this vulnerability is exploited, an attacker may tamper with the settings of the device by obtaining the credentials. This vulnerability is caused by an insufficient fix for...
SugarCRM 14.0.0 - SSRF/Code Injection
Exploit Title : SugarCRM 14.0.0 - SSRF/Code Injection Author: Egidio Romano aka EgiX Email : [email protected] Software Link: https://www.sugarcrm.com Affected Versions: All commercial versions before 13.0.4 and 14.0.1. CVE Reference: CVE-2024-58258 Vulnerability Description: User input passed...
The vulnerability of the Linux operating system’s kernel, related to errors in resource release, allows a hacker to cause a service failure.
The vulnerability of the Linux operating system’s kernel is related to errors during resource release. Exploiting this vulnerability can allow an attacker to cause service failures...
CVE-2025-53023
CVE-2025-53023 is a MySQL Server vulnerability in the replication component. Affected are MySQL 8.0.0–8.0.42. The issue allows a high-privileged attacker with network access via multiple protocols to cause a hang or a frequent crash (DOS) of MySQL Server. The CVSS v3.1 base score is 4.9 (Availabi...
Directus' exact version number is exposed by the OpenAPI Spec
Summary The exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the /server/specs/oas endpoint without authentication. Impact With the exact version information a malicious attacker can look for known vulnerabilities in Directus...
Autodesk Revit RFA File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk Revit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of RFA...
CVE-2025-49677
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally...
CVE-2025-42965
SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitati...
CVE-2025-53184
Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability...
CVE-2025-53174
Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the file preview function...
CVE-2025-53182
Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability...
CVE-2025-53171
Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the file preview function...
PT-2025-28709 · Irfanview · Irfanview
Name of the Vulnerable Software and Affected Versions: IrfanView CADImage Plugin affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit the issue, as...
CVE-2025-48501
An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed on the server where the product is running...
