2025

Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reus

In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all se

A vulnerability has been identified in OpenV2G (All versions < V0.9.6). The OpenV2G EXI parsing feature is missing a len

A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (All versions < V4.7), S

A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1

The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API

In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could con

A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All v

A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1). An example se

A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions),

A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP200) (All ve

The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory reso

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to

The login functionality of the web server in affected devices does not normalize the response times of login attempts. A

A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the

The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the

A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_relo

In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for

A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_

SolarWinds Platform is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient

Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a l

SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive in

A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bf

A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is t

A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import

A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_m

The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it bac

The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privile

The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it ba

Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsi

A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affe

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pl

A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affe

NetVision Information ISOinsight has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote att

A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been declared as critical. Th

A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical. Affected

A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vuln

Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests

SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This incl

SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protect

The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific

SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenti

SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deplo

SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (

SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respon

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows t

Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker cou

Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker c

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scriptin