2025

The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent

The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heap

The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses,

The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then

Netwrix Directory Manager (formerly Imanami GroupID) v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Authe

Dell PowerStore, version(s) 4.0.0.0, contain(s) an Use of Hard-coded Credentials vulnerability in the PowerStore image f

Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. M

SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be direct

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.0.1 could allow a remote attacker to traverse directories on the system. A

IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than

Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT req

A vulnerability, which was classified as critical, has been found in SourceCodester Computer Store System 1.0. This issu

The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions u

The WP Attachments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attachment_id’ paramete

A integer overflow or wraparound in Fortinet FortiOS versions 7.2.0 through 7.2.7, versions 7.0.0 through 7.0.14 may all

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through

libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is n

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an I

IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of

IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authent

IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error

On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection confi

IBM DS8900F and DS8A00 Hardware Management Console (HMC) is vulnerable to stored cross-site scripting. This vulnerabilit

On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly

Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address s

Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap c

Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The

A flaw was found in Stackrox, where it is vulnerable to Cross-site scripting (XSS) if the script code is included in a s

Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform U

Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker wh

Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker t

Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker t

code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) via the name field in the fee

maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management.

An issue was discovered in Wi-Fi in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1

NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the len

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 128

In the function process_crypto_cmd, the values of ptrs[i] can be potentially equal to NULL which is valid value after ca

There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. This could lead to local inform

A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_s

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DBAR Productions V

Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerab

A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious

Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leak

Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user in

Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into

Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin lea

A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the funct