2025

Many fields for the web configuration interface of the firmware for Mennekes Smart / Premium Chargingpoints can be abuse

The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files

The authenticated SCU firmware command of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for com

The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for

The authenticated firmware update capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused f

This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmwa

LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's buc

A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions.

A buffer overread can occur in the CPC application when operating in full duplex SPI upon receiving an invalid packet ov

Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnera

Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for productio

Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for productio

SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an

Pass-Back vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated a

fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could

Collabora Online is a collaborative online office suite based on LibreOffice. Macro support is disabled by default in Co

Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are

Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, migh

Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are

A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sens

Ad Inserter - Ad Manager and AdSense Ads 2.8.0 was found to be vulnerable. The web application dynamically generates web

Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lea

OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability

Lack of Rate Limiting in Sign-up workflow in Perforce Gliffy prior to version 4.14.0-7 on Gliffy online allows attacker

Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 b

conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional depend

A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file

A privilege escalation vulnerability in PocketBook InkPad Color 3 allows attackers to escalate to root privileges if the

Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12

aes-gcm is a pure Rust implementation of the AES-GCM. In decrypt_in_place_detached, the decrypted ciphertext (which is t

The MouseTooltipTranslator Chrome extension allows mouseover translation of any language at once. The MouseTooltipTransl

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows H

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows Po

Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with

MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to RELEASE.2025-02-28T09

PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is us

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded t

It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page.

Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the

In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgIn

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For"

An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a

DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent wit

FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable.

The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including sup

A flaw in Gliffy results in broken authentication through the reset functionality of the application.

Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Sit

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirem