2025

Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server

External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version

Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted function

Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows

AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker

In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab

In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources

Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reus

PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that c

In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all se

A vulnerability has been identified in OpenV2G (All versions < V0.9.6). The OpenV2G EXI parsing feature is missing a len

A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (All versions < V4.7), S

A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0), SIMATIC S7-1200 CPU 121

A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1

A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1

A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions). The

A vulnerability has been identified in Teamcenter V14.1 (All versions), Teamcenter V14.2 (All versions), Teamcenter V14.

The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API

In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could con

A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All v

A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All v

A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All ve

A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1). An example se

A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions),

A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP200) (All ve

A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Up

The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory reso

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to

The login functionality of the web server in affected devices does not normalize the response times of login attempts. A

An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to uplo

The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password ca

A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the

The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the

In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a targ

A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_relo

In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for

A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_

A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_

SolarWinds Platform is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient

The SolarWinds Platform is vulnerable to an information disclosure vulnerability through an error message. While the dat

SolarWinds Platform is affected by server-side request forgery vulnerability. Proper input sanitation was not applied al

Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a l

SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive in

The Zox News - Professional WordPress News & Magazine Theme plugin for WordPress is vulnerable to unauthorized data modi

A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bf

A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is t

The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to,

The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7.

A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import