2025

Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Passwordless on Windows allows Priv

A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. Affected is an unknown fu

A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been rated as problematic. This issue affects some u

A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affect

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocatio

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO a

Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Cre

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality

Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single

A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inj

Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information via

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticat

A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitr

A vulnerability in an API subsystem of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual

A vulnerability in the web-based management interface of Cisco Secure Network Analytics Manager and Cisco Secure Network

A vulnerability in client join services of Cisco Webex Meetings could allow an unauthenticated, remote attacker to manip

A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) a

A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) a

A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) a

A vulnerability in the Cloud Connect component of Cisco Unified Contact Center Enterprise (CCE) could allow an unauthent

A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthen

A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform

A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges

A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authentica

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in HYPR Passwo

The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the C

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer

The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.

The ns_backup extension through 13.0.0 for TYPO3 allows XSS.

The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference.

The ns_backup extension through 13.0.0 for TYPO3 allows command injection.

The cs_seo extension through 9.2.0 for TYPO3 allows XSS.

The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.

The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.

The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.

An issue in Valvesoftware Steam Client Steam Client 1738026274 allows attackers to escalate privileges via a crafted exe

An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell script

A vulnerability has been found in Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0 Patch April 2025 and classifie

jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning va

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4B

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter in the web_rmon_alarm_p

itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users t

AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.

The certificate and private key used for providing transport layer security for connections to the web interface (TCP po

An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image fo

A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The

When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG conta

Data provided in a request performed to the server while activating a new device are put in a database. Other high privi

Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-p