757 matches found
CVE-2025-30731
...
CVE-2025-30689
CVE-2025-30689 — Oracle MySQL Server (Optimizer) is validated by connected advisories as affecting MySQL Server’s Optimizer component across versions 8.0.0–8.0.41, 8.4.0–8.4.4, and 9.0.0–9.2.0. The issue is exploitable by a high-privilege attacker with network access via multiple protocols, poten...
CVE-2025-32728
A flaw was found in OpenSSH. In affected versions of sshd, the DisableForwarding directive does not fully adhere to the intended functionality as documented. Specifically, it fails to disable X11 and agent forwarding, which may allow unintended access under certain configurations. Mitigation To...
CVE-2025-32016 Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs
Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...
ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031
This module enables you to define automations on your Drupal site. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability can be mitigated by disabling the "ecaui" submodule, which leaves ECA functionality intact, but the vulnerable routes will no longer be...
PT-2025-15354 · Unknown · Mymagicpower Aias
Name of the Vulnerable Software and Affected Versions: mymagicpower AIAS version 20250308 Description: A critical issue has been found in the processing of the file 3 api platform/api-platform/src/main/java/top/aias/platform/controller/AsrController.java. The manipulation of the url argument lead...
WordPress EazyDocs plugin <= 2.7.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin EazyDocs versions = 2.7.1...
WordPress ZoomSounds - WordPress Wave Audio Player with Playlist plugin <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation vulnerability
WordPress ZoomSounds - WordPress Wave Audio Player with Playlist plugin = 6.91 - Missing Authorization to Authenticated Subscriber+ Limited Options Update and Settings Manipulation vulnerability discovered by Lucio Sá in WordPress Plugin ZoomSounds versions = 6.91...
PT-2025-14891 · Edimax · Edimax Ac1200 Wave 2 Dual-Band Gigabit Router Br-6478Ac V3
Name of the Vulnerable Software and Affected Versions: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 version 1.0.15 Description: A command injection issue was discovered via the fota url in the "/boafrm/formLtefotaUpgradeQuectel" API endpoint. This allows for potential exploitation. ...
PT-2025-14832 · Unknown · Codeastro Student Grading System
Name of the Vulnerable Software and Affected Versions: CodeAstro Student Grading System version 1.0 Description: A critical issue was found in the CodeAstro Student Grading System, affecting an unknown part of the file studentsubject.php. The manipulation of the studentId argument leads to SQL...
CVE-2025-31483
Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/ route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed...
CVE-2025-31483 Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration
Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/ route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed...
CVE-2025-32051
A flaw was found in libsoup. The libsoup soupuridecodedatauri function may crash when processing malformed data URI. This flaw allows an attacker to cause a denial of service DoS. Mitigation No mitigation is currently available for this vulnerability...
CVE-2025-21935
In the Linux kernel, the following vulnerability has been resolved: rapidio: add check for rioaddnet in rioscanallocnet The return value of rioaddnet should be checked. If it fails, putdevice should be called to free the memory and give up the reference initialized in rioaddnet...
Security Bulletin: IBM Storage Protect Server is susceptible to vulnerability in Golang Go (CVE-2024-34158, CVE-2024-34155, CVE-2024-34156).
Summary Golang Go is used by the IBM Storage Protect Server OSSM component and is affected by multiple vulnerabilities that could lead to a denial-of-service DoS attack on the host system. This bulletin provides the necessary steps to mitigate these vulnerabilities. Vulnerability Details...
CVE-2025-31335
A flaw was found in the OpenSAML C++ library. This vulnerability allows forging signed SAML messages via parameter manipulation when using SAML bindings that rely on non-XML signatures. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the...
CVE-2025-2901
A flaw was found in the JBoss EAP Management Console, where a stored Cross-site scripting vulnerability occurs when an application improperly sanitizes user input before storing it in a data store. When this stored data is later included in web pages without adequate sanitization, malicious scrip...
CVE-2023-53024
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To mitigate Spectre v4, 2039f26f3aca "bpf: Fix leakage due to insufficient speculative store bypass mitigation" inserts lfence instructions after 1...
CVE-2023-53024 bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To mitigate Spectre v4, 2039f26f3aca "bpf: Fix leakage due to insufficient speculative store bypass mitigation" inserts lfence instructions after 1...
PT-2025-12801
Name of the Vulnerable Software and Affected Versions D-Link DIR-823X versions 240126 and 240802 Description A command injection issue exists due to insufficient data sanitization at the control level. An authorized attacker can execute arbitrary commands on remote devices by sending a POST reque...