default_status: unknown

product: Abacus

vendor: Abacus Research AG

status: affected

version_type: custom

ecosystem: software/application

metric_type: Secondary

severity: medium

quality: metadata-backed

recipe_kind: composed

status: Deferred

summary: Abacus ERP is versions older than 2024.210.16036, 2023.205.15833, 2022.105.15542 are affected by an authenticated arbitrary file read vulnerability.

title: Abacus Research Ag Abacus security vulnerability


default_status: affected

product: Xilinx Run Time (XRT)

vendor: AMD

status: unaffected

severity: high

summary: Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability

title: Amd Xilinx Run Time (Xrt) security vulnerability


summary: Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in crash or denial of service.


archetype: generic

summary: Insufficient validation within Xilinx Run Time framework could allow a local attacker to escalate privileges from user space to kernel space, potentially compromising confidentiality, integrity, and/or availability.


product: AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics

version: AMD Software: Adrenalin Edition 24.10.1 (24.20.19.01), AMD Software: PRO Edition 24.Q4 (24.20.30)

product: AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics

product: AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics

product: AMD Ryzen™ 7000 Series Desktop Processors

product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics

product: AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics

product: AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics

product: AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics

product: AMD Ryzen™ 7000 Series Mobile Processors

product: AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics

product: AMD Ryzen™ 7000 Series Processors with Radeon™ Graphics

product: AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics

summary: A NULL pointer dereference in AMD Crash Defender could allow an attacker to write a NULL output to a log file potentially resulting in a system crash and loss of availability.

title: Amd Amd Ryzen™ 7035 Series Processor With Radeon™ Graphics security vulnerability


product: AMD Radeon™ RX 5000 Series Graphics Products

version: Radeon Software for Linux 24.30.2

product: AMD Radeon™ RX 6000 Series Graphics Products

product: AMD Radeon™ RX 7000 Series Graphics Products

product: AMD Radeon™ RX Vega Series Graphics Cards

product: AMD Radeon™ PRO W5000 Series Graphics Products

product: AMD Radeon™ PRO W6000 Series Graphics Products

product: AMD Radeon™ PRO W7000 Series Graphics Products

product: AMD Radeon™ VII

product: AMD Instinct™ MI200

version: ROCm 6.3

product: AMD Instinct™ MI210

product: AMD Instinct™ MI250

product: AMD Instinct™ MI300A

summary: An out of bounds write in the Linux graphics driver could allow an attacker to overflow the buffer potentially resulting in loss of confidentiality, integrity, or availability.

title: Amd Amd Radeon™ Rx 5000 Series Graphics Products security vulnerability


product: AMD EPYC™ 9005 Series Processors

product: AMD EPYC™ Embedded 9005 Series Processors

summary: Improper handling of overlap between the segmented reverse map table (RMP) and system management mode (SMM) memory could allow a privileged attacker corrupt or partially infer SMM memory resulting in loss of integrity or confidentiality.

title: Amd Amd Epyc™ 9005 Series Processors security vulnerability


product: AMD Ryzen™ AI Software

summary: Incorrect default permissions on the AMD Ryzen(TM) AI installation folder could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

title: Amd Amd Ryzen™ Ai Software security vulnerability


default_status: unaffected

product: Valhall GPU Kernel Driver

vendor: Arm Ltd

version_type: patch

part: a

vendor: arm

status: Analyzed

summary: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to make improper GPU processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0; Arm 5th Gen GPU Architecture Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0.

title: Arm 5Th Gen Gpu Architecture Kernel Driver security vulnerability


product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")

product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")

product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")

product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt")

product: AMD Ryzen™ Embedded 8000 Series Processors

version: AMD Ryzen™ Chipset Driver 7.06.02.123

status: Awaiting Analysis

summary: An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an arbitrary address potentially resulting in loss of confidentiality, integrity, or availability.

title: Amd Amd Ryzen™ 7035 Series Processors With Radeon™ Graphics (Formerly C… security vulnerability


product: AMD EPYC™ 9004 Series Processors

version: GenoaPI 1.0.0.G

product: AMD EPYC™ 7003 Series Processors

version: MilanPI 1.0.0.H

version: TurinPI 1.0.0.5

product: AMD EPYC™ 8004 Series Processors

product: AMD EPYC™ Embedded 7003 Series Processors

version: EmbMilanPI-SP3 v9 1.0.0.C

product: AMD EPYC™ Embedded 9003 Series Processors

version: EmbGenoaPI-SP5 1.0.0.B

product: AMD EPYC™ Embedded 9004 Series Processors

product: AMD EPYC™ Embedded 8004 Series Processors

summary: A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLE_SOCKET policy on a different socket than the migration agent potentially resulting in loss of integrity.

title: Amd Amd Epyc™ 9004 Series Processors security vulnerability


version: TurinPI 1.0.0.4

product: AMD Ryzen™ AI 300 Series Processors

product: AMD Ryzen™ 9000 Series Desktop Processors

version: ComboAM5PI 1.2.0.3c

product: AMD Ryzen™ 9000HX Series Processors

version: FireRangeFL1PI 1.0.0.0a

product: AMD Ryzen™ Al Max+

product: AMD Ryzen™ Threadripper™ 9000 series

version: ShimadaPeakPI-SP6 1.0.0.1

product: AMD EPYC™ Embedded 9000 Series Processors

version: Embturin PI 1.0.0.0

summary: Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcode, potentially resulting in loss of integrity of x86 instruction execution.


product: AMD EPYC™ 7003 Series Processors (formerly codenamed "Milan")

product: AMD EPYC™ 9005 Series Processors (formerly codenamed "Turin")

version: TurinPI 1.0.0.6

summary: Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a loss of SEV-SNP guest memory integrity.

title: Amd Amd Epyc™ 7003 Series Processors (Formerly Codenamed "Milan") security vulnerability


product: AMD Instinct™ MI300X

product: AMD Instinct™ MI325X

summary: Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cause read or write past the end of allocated arrays, potentially resulting in a loss of platform integrity or denial of service.

title: Amd Amd Instinct™ Mi300X security vulnerability


product: AMD Cloud Manageability Service

summary: Unquoted search path within AMD Cloud Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbitrary code execution.

title: Amd Amd Cloud Manageability Service security vulnerability


product: Platform Loader and Manager (PLM)

version: Refer to AMD-SB-8010

summary: In AMD Versal Adaptive SoC devices, the lack of address validation when executing PLM runtime services through the PLM firmware can allow access to isolated or protected memory spaces, resulting in the loss of integrity and confidentiality.

title: Amd Platform Loader And Manager (Plm) security vulnerability


product: Kria(TM) SOM

version: PMU Firmware version TBD

product: Zynq UltraScale+ MPSoCs

product: Zynq UltraScale+ RFSoCs

summary: In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow access to isolated or protected memory spaces resulting in the loss of integrity and confidentiality.

title: Amd Kria(Tm) Som security vulnerability


product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics

product: AMD Ryzen™ 8000 Series Desktop Processors

version: ComboAM5PI 1.2.0.3d

version: ComboAM5PI 1.1.0.3d

product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics

product: AMD Ryzen™ Embedded 8000 Series Processors

summary: Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physical access to read or overwrite the contents of cross-chip debug (XCD) registers potentially resulting in loss of data integrity or confidentiality.

title: Amd Amd Ryzen™ 7040 Series Mobile Processors With Radeon™ Graphics security vulnerability


product: Vitis™ Embedded Single File Download (SFD) for Windows

ecosystem: windows/system

summary: Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution.

title: Amd Vitis™ Embedded Single File Download (Sfd) For Windows security vulnerability


product: AMD Ryzen™ Al Max+

version: AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20)

product: AMD Ryzen™ AI 300 Series Processors

version: Graphics driver: version 25.6.1, branch: 25.10.13.01. - Chipset version: 7.06.02.123

product: AMD Radeon™ RX 7000 Series Graphics Products

product: AMD Radeon™ PRO W7000 Series Graphics Products

summary: An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially lead to a partial loss of confidentiality and availability.

title: Amd Amd Ryzen™ Al Max+ security vulnerability


product: Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics

version: AMD Ryzen™ Chipset Driver 7.02.13.148 with PSP driver 5.38.0.0

product: Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics

product: Ryzen™ 6000 Series Processors with Radeon™ Graphics Ryzen™ 7035 Series Processors with Radeon™ Graphics

product: Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics

product: Ryzen™ 7020 Series Processors with Radeon™ Graphics

product: AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics

product: AMD Ryzen™ Z1 Series Processors

product: AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics

product: AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors

product: AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics

product: AMD Ryzen™ Threadripper™ 3000 Series Processors

summary: Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker to create a buffer overflow condition, potentially resulting in a crash or denial of service

title: Amd Athlon™ 3000 Series Mobile Processors With Radeon™ Graphics security vulnerability


product: AMD Power Design Manager (PDM) Software Installer for Windows

summary: Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.


product: GoAnywhere

vendor: Fortra

version_type: semver

metric_type: Primary

severity: low

vendor: fortra

summary: When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.

title: Fortra Goanywhere Managed File Transfer security vulnerability


product: Valhall GPU Userspace Driver

product: Bifrost GPU Userspace Driver

summary: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to make valid GPU processing operations, including via WebGL or WebGPU, to access a limited amount outside of buffer bounds.This issue affects Bifrost GPU Userspace Driver: from r0p0 through r49p2, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r19p0 through r49p2, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r49p2, from r50p0 through r53p0.

title: Arm 5Th Gen Gpu Architecture Userspace Driver security vulnerability


product: FlashArray

vendor: Pure Storage

version_type: cpe

summary: Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service.


product: FlashBlade

summary: Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service.


version: SAP_BASIS 700

version: SAP_BASIS 701

version: SAP_BASIS 702

version: SAP_BASIS 731

version: SAP_BASIS 740

version: SAP_BASIS 750

version: SAP_BASIS 751

version: SAP_BASIS 752

version: SAP_BASIS 753

version: SAP_BASIS 754

version: SAP_BASIS 755

version: SAP_BASIS 756

version: SAP_BASIS 757

vendor: sap

summary: SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthenticated attacker could retrieve details such as system configuration. This has a limited impact on the confidentiality of the application and may be leveraged to facilitate further attacks or exploits.


product: SAP NetWeaver Application Server Java

version: EP-BASIS 7.50

version: FRAMEWORK-EXT 7.50

ecosystem: java/maven

summary: SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.


product: SAP GUI for Windows

version: BC-FES-GUI 8.0

summary: SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administrative privileges or access to the victim's user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.


product: SAP GUI for Java

version: BC-FES-JAV 7.80

summary: SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim's user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.


version: ENGINEAPI 7.50

version: SERVERCORE 7.50

version: UMEADMIN 7.50

summary: SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of victim's web browser.


version: SAP_BASIS 758

version: SAP_BASIS 912

version: SAP_BASIS 913

version: SAP_BASIS 914

summary: In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the information unavailable.

title: Sap Sap Basis security vulnerability


product: SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

version: KRNL64UC 7.53

version: KERNEL 7.53

summary: Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim's user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.

title: Sap Se Sap Netweaver Application Server Abap (Applications Based On Sap… security vulnerability


version: ENTERPRISE 420

summary: SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged user causing high impact on confidentiality and integrity of the application.

title: Sap Businessobjects Business Intelligence Platform security vulnerability


severity: critical

summary: SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application.


version: ENTERPRISE 430

version: ENTERPRISECLIENTTOOLS 430

ecosystem: javascript/npm

summary: SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impact on confidentiality and integrity within the scope of victim's browser. There is no impact on availability. This vulnerability occurs only when script/html execution is enabled by the administrator in Central Management Console.


product: SAP NetWeaver AS ABAP and ABAP Platform

version: SAP_BASIS 700

version: SAP_BASIS 701

version: SAP_BASIS 702

version: SAP_BASIS 731

version: SAP_BASIS 740

version: SAP_BASIS 750

version: SAP_BASIS 751

version: SAP_BASIS 752

version: SAP_BASIS 753

version: SAP_BASIS 754

version: SAP_BASIS 755

version: SAP_BASIS 756

version: SAP_BASIS 757

summary: SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.


product: SAP BusinessObjects Business Intelligence platform (Central Management Console)

summary: Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This results in a high impact on confidentiality and integrity, with no impact on availability.


product: Remote Full Client

vendor: TeamViewer

product: Remote Host

summary: Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior version 15.62 for Windows allows an attacker with local unprivileged access on a Windows system to elevate privileges via argument injection.

title: Teamviewer Remote Full Client security vulnerability


version: SAP_BASIS 758

version: SAP_BASIS 912

version: SAP_BASIS 913

version: SAP_BASIS 914

summary: Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an application

title: Sap Sap Basis security vulnerability


version: WD-RUNTIME 7.50

summary: Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on confidentiality, integrity, and availability of the application.

title: Sap Se Sap Netweaver Application Server Java security vulnerability


product: SAP NetWeaver Application Server ABAP

version: SAP_BASIS 700

version: SAP_BASIS 701

summary: An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.


product: SAPSetup

version: LMSAPSETUP 9.0

summary: Due to DLL injection vulnerability in SAPSetup, an attacker with either local user privileges or with access to a compromised corporate user's Windows account could gain higher privileges. With this, he could move laterally within the network and further compromise the active directory of a company. This leads to high impact on confidentiality, integrity and availability of the Windows server.

title: Sap Se Sapsetup security vulnerability


version: KRNL64NUC 7.22

version: KRNL64UC 7.22

version: KERNEL 7.22

summary: SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication checks, resulting in privilege escalation. On successful exploitation, this can result in potential security concerns. This results in a high impact on confidentiality, integrity, and availability.

title: Sap Se Sap Netweaver Application Server For Abap And Abap Platform security vulnerability


version: KRNL64UC 7.53

version: WEBDISP 7.53

version: KERNEL 7.53

summary: SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter value. This exposes unencrypted passwords in the logs, causing a high impact on the confidentiality of the application. There is no impact on integrity or availability.

title: Sap Se Sap Web Dispatcher And Internet Communication Manager security vulnerability


product: Valhall GPU Kernel Driver

status: Modified

summary: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p3, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p3, from r50p0 through r53p0.

title: Arm 5Th Gen Gpu Architecture Kernel Driver security vulnerability


summary: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 before r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 before r54p0.


product: Android

vendor: Google

ecosystem: operating-system

part: o

product: android

vendor: google

summary: In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.


summary: In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.


summary: In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.


summary: In main of main.cpp, there is a possible way to bypass SELinux due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.


summary: In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.


summary: In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.


summary: In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.


archetype: ssrf

summary: In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

title: Google Android security vulnerability


summary: In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.


summary: In multiple locations, there is a possible out of bounds write due to a use after free. This could lead to remote code execution over Bluetooth, if HFP support is enabled, with no additional execution privileges needed. User interaction is not needed for exploitation.


summary: In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.


summary: In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.


summary: In multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.


summary: In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficient UI. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.


summary: In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.


vendor: WAGO

summary: A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes some functions to work unexpected or stop working at all. Both during runtime and after a restart.


product: Expedition

vendor: Palo Alto Networks

product: expedition

vendor: paloaltonetworks

summary: An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers to create and read arbitrary files on the Expedition system.

title: Paloaltonetworks Expedition security vulnerability


summary: A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.


summary: An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem.


summary: A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesystem.


summary: An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.


product: PAN-OS

business_risk: Critical risk when the PAN-OS management web interface is reachable from the internet or another untrusted network. An unauthenticated network attacker can bypass management-interface authentication and invoke certain PHP scripts, potentially affecting PAN-OS confidentiality and integrity. Palo Alto Networks reports observed exploit attempts chaining this vulnerability with CVE-2024-9474 and CVE-2025-0111. The issue does not provide remote code execution by itself. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2025-0108?utm_source=openai))

claim: PAN-OS is affected; Cloud NGFW and Prisma Access are listed as unaffected.

claim: Affected PAN-OS ranges include versions below the vendor-listed fixed releases in the 10.1, 10.2, 11.1, and 11.2 branches; listed end-of-life branches are presumed affected.

claim: Exploitation requires network access to the PAN-OS management web interface; risk is greatest when it is reachable from the internet or an untrusted network, directly or through a dataplane interface with a management interface profile.

kind: exposure

claim: Palo Alto Networks recommends upgrading to the applicable fixed release and restricting management-interface access to trusted internal IP addresses or a jump box; it also documents Threat IDs 510000 and 510001 as an additional mitigation when the required subscription and content version are available.

kind: remediation

claim: The advisory provides an administrative verification path through the Customer Support Portal's Remediation Required asset list and recommends validating that management access is restricted to trusted internal IP addresses.

kind: verification

exposure_conditions: PAN-OS management web-interface access is reachable from the internet or another untrusted network.

exposure_conditions: Exposure can occur directly or through a dataplane interface with a management interface profile.

exposure_conditions: GlobalProtect portals and gateways are not themselves vulnerable, but configuring a management profile on their interfaces exposes the device through the management web interface, typically on port 4443.

exposure_conditions: Cloud NGFW and Prisma Access are not affected according to the vendor advisory.

exposure_conditions: PAN-OS 11.0, 10.0, 9.1, 9.0, and older end-of-life releases are presumed affected because they are no longer evaluated and have no planned fixes. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2025-0108?utm_source=openai))

recipe_specificity: specific

remediation_steps: Upgrade PAN-OS 10.1 installations to 10.1.14-h9 or later.

remediation_steps: For PAN-OS 10.2, upgrade to the applicable fixed release: 10.2.7-h24, 10.2.8-h21, 10.2.9-h21, 10.2.10-h14, 10.2.11-h12, 10.2.12-h6, or 10.2.13-h3 or later, as applicable to the installed minor release.

remediation_steps: For PAN-OS 11.1, upgrade to 11.1.2-h18, 11.1.4-h13, or 11.1.6-h1 or later, as applicable to the installed minor release.

remediation_steps: For PAN-OS 11.2, upgrade 11.2.4 installations to 11.2.4-h4 or later, or upgrade to 11.2.5 or later. Other 11.2 releases should be upgraded to 11.2.5 or later.

remediation_steps: Replace unsupported PAN-OS branches with a supported fixed version; the vendor states that no fixes are planned for the listed end-of-life branches.

remediation_steps: Immediately restrict management-interface access to trusted internal IP addresses or an approved jump box, rather than exposing it to the internet or untrusted networks.

remediation_steps: If a Threat Prevention subscription is available, enable vendor Threat IDs 510000 and 510001 using Applications and Threats content version 8943 or later, as an additional mitigation. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2025-0108?utm_source=openai))

status: complete

uncertainty: The supplied source record lists selected affected CPEs and thresholds, while the vendor advisory provides branch-specific hotfix paths; the vendor advisory should control remediation selection.

uncertainty: The vendor advisory does not establish that a particular customer device is currently exposed or compromised; exposure must be determined from the device's management-interface configuration and authorized asset inventory.

uncertainty: A version comparison alone does not establish whether the management interface is reachable from an untrusted network.

uncertainty: The vendor's Threat Prevention mitigation is conditional on a Threat Prevention subscription and the specified content version.

verification_steps: Using an authorized administrative inventory or management interface, confirm the running PAN-OS version and compare it with the applicable fixed-version threshold in the Palo Alto Networks advisory.

verification_steps: Confirm that management-interface access is limited to trusted internal IP addresses or an approved jump box, and that no internet-facing or untrusted dataplane interface has a management interface profile.

verification_steps: Review the Palo Alto Networks Customer Support Portal Assets section at Products → Assets → All Assets → Remediation Required for devices tagged PAN-SA-2024-0015; the vendor notes that absence from the list only means its recent scan did not identify an exposed device and is not a complete configuration validation.

verification_steps: If relying on the Threat Prevention mitigation, confirm through authorized administrative review that Threat IDs 510000 and 510001 are enabled and that the required Applications and Threats content version is installed. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2025-0108?utm_source=openai))

known_ransomware_campaign_use: Unknown

required_action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

vendor_project: Palo Alto Networks

vulnerability_name: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

author: Codex

description: CVE-2025-0108 is CISA KEV PAN-OS auth bypass. NVD range CPE excludes 10.1.14 / 10.2.7 / 11.1.2 / 11.2.4. Vendor names later hotfixes.

maturity: development

title: CVE-2025-0108: PAN-OS authentication bypass

product: pan-os

recipe_kind: markdown-draft

summary: An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.


summary: An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

title: Palo Alto Networks Pan-Os security vulnerability


product: PAN-OS OpenConfig Plugin

summary: A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI requests to the PAN-OS management web interface to bypass system restrictions and run arbitrary commands. The commands are run as the “__openconfig” user (which has the Device Administrator role) on the firewall. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

title: Palo Alto Networks Pan-Os Openconfig Plugin security vulnerability


vulnerability_name: Palo Alto Networks PAN-OS File Read Vulnerability

summary: An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.


product: Cortex XDR Agent

summary: A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activity.

title: Palo Alto Networks Cortex Xdr Agent security vulnerability


product: Cortex XDR Broker VM

summary: A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs transmitted by the Cortex XDR Agent to the Cortex XDR server.

title: Palo Alto Networks Cortex Xdr Broker Vm security vulnerability


summary: A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the service unavailable by sending a large number of specially crafted packets over a period of time. This issue affects both the GlobalProtect portal and the GlobalProtect gateway. This issue does not apply to Cloud NGFWs or Prisma Access software.

title: Paloaltonetworks Pan-Os security vulnerability


summary: A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files. The attacker must have network access to the management interface (web, SSH, console, or telnet) and successfully authenticate to exploit this issue. You can greatly reduce the risk of this issue by restricting access to the management interface to only trusted users and internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access.


summary: A Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software causes the firewall to unexpectedly reboot when processing a specially crafted LLDP frame sent by an unauthenticated adjacent attacker. Repeated attempts to initiate this condition causes the firewall to enter maintenance mode. This issue does not apply to Cloud NGFWs or Prisma Access software.


platforms:
Windows
iOS
Android
Chrome OS
macOS

product: GlobalProtect App

version: All

summary: A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. GlobalProtect App on macOS, Linux, iOS, Android, Chrome OS and GlobalProtect UWP App are not affected.

title: Palo Alto Networks Globalprotect App security vulnerability


platforms:
Windows
macOS
Linux
iOS
Android
Chrome OS

product: globalprotect

summary: A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device. This issue does not apply to the GlobalProtect app on other (non-Windows) platforms.

title: Paloaltonetworks Globalprotect security vulnerability


summary: A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS commands with root privileges on the host operating system running Broker VM.


summary: A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user can also successfully exploit a race condition, which makes this vulnerability difficult to exploit.


summary: A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the agent. Additionally, malware can use this vulnerability to perform malicious activity without Cortex XDR being able to detect it.


product: Prisma SD-WAN

summary: A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to disrupt the packet processing capabilities of the device by sending a burst of crafted packets to that device.

title: Palo Alto Networks Prisma Sd-Wan security vulnerability


summary: A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/take-packet-captures/take-a-custom-packet-capture in decrypted HTTP/2 data streams traversing network interfaces on the firewall. HTTP/1.1 data streams are not impacted. In normal conditions, decrypted packet captures are available to firewall administrators after they obtain and install a free Decryption Port Mirror license. The license requirement ensures that this feature can only be used after approved personnel purposefully activate the license. For more information, review how to configure decryption port mirroring https://docs.paloaltonetworks.com/network-security/decryption/administration/monitoring-decryption/configure-decryption-port-mirroring . The administrator must obtain network access to the management interface (web, SSH, console, or telnet) and successfully authenticate to exploit this issue.


product: Cloud NGFW

summary: An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue affects Cloud NGFW. However, this issue does not affect Prisma® Access software.


summary: An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW and all Prisma® Access instances.


product: Prisma Access

summary: When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. The SAML login for the PAN-OS® management interface is not affected. Additionally, this issue does not affect Cloud NGFW and all Prisma® Access instances are proactively patched.


summary: A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. This issue is only applicable to PAN-OS VM-Series. This issue does not affect firewalls that are already deployed. Cloud NGFW and Prisma® Access are not affected by this vulnerability.


summary: A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. Cloud NGFW is not affected by this vulnerability. Prisma® Access software is proactively patched and protected from this issue.


product: Prisma Access Browser

summary: An improper exception check in Palo Alto Networks Prisma Access Browser allows a low privileged user to prevent Prisma Access Browser from applying it's Policy Rules. This enables the user to use Prisma Access Browser without any restrictions.

title: Palo Alto Networks Prisma Access Browser security vulnerability


summary: A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeated successful attempts to trigger this condition will cause the firewall to enter maintenance mode. This issue does not affect Cloud NGFW or Prisma Access.


product: MetaDefender Endpoint Security SDK

vendor: OPSWAT

summary: An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user also successfully exploits a race condition, which makes this vulnerability difficult to exploit.

title: Opswat Metadefender Endpoint Security Sdk security vulnerability


summary: A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM. The attacker must have network access to the Broker VM to exploit this issue.


summary: A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM.


platforms:
macOS
Android
Chrome OS
iOS
Windows
Linux

summary: An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app. The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.


summary: Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Series) leads to unencrypted data transfer to devices that are connected to the PAN-OS firewall through IPSec. This issue does not affect Cloud NGFWs, Prisma® Access instances, or PAN-OS VM-Series firewalls. NOTE: The AES-128-CCM encryption algorithm is not recommended for use.


summary: An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .


product: Autonomous Digital Experience Manager

summary: An incorrect privilege assignment vulnerability in Palo Alto Networks Autonomous Digital Experience Manager allows a locally authenticated low privileged user on macOS endpoints to escalate their privileges to root.

title: Palo Alto Networks Autonomous Digital Experience Manager security vulnerability


summary: An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.


platforms:
macOS
Windows
Android
Chrome OS
iOS
Linux

summary: An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.


product: Zoom Jenkins Marketplace plugin

vendor: Zoom Communications, Inc

summary: Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of information via network access.

title: Zoom Communications, Inc Zoom Jenkins Marketplace Plugin security vulnerability


product: Zoom Workplace Apps for Linux

vendor: zoom

summary: Out-of-bounds write in the Zoom Workplace App for Linux before version 6.2.5 may allow an unauthorized user to conduct a denial of service via network access.

title: Zoom Meeting Software Development Kit security vulnerability


platforms: Linux MacOS Windows iOS Android

product: Zoom Workplace Apps

version: see references

product: rooms

summary: Out-of-bounds write in some Zoom Workplace Apps may allow an authorized user to conduct a loss of integrity via network access.


product: Zoom Workplace Apps for Windows

summary: Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.


product: Zoom Workplace app for macOS

summary: Symlink following in the installer for Zoom Workplace App for macOS before 6.2.10 may allow an authenticated user to conduct a denial of service via local access.


product: Zoom Workplace App for Linux

summary: Type confusion in the Zoom Workplace App for Linux before 6.2.10 may allow an authorized user to conduct an escalation of privilege via network access.


platforms: Windows MacOS Linux iOS Android

product: Zoom Apps

version: See references

summary: Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.


product: Zoom Workplace Apps for iOS

product: workplace

summary: Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network access.


platforms: iOS Windows MacOS Linux Android

version: See references.

summary: Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.


vendor: IBM

vendor: ibm

summary: IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

title: Ibm Engineering Requirements Management Doors Web Access security vulnerability


product: TXSeries for Multiplatforms

summary: IBM TXSeries for Multiplatforms 9.1 and 11.1 could disclose sensitive information to a remote attacker due to improper neutralization of HTTP headers.

title: Ibm Txseries For Multiplatforms security vulnerability


product: EntireX

product: entirex

summary: IBM EntireX 11.1 could allow a local user to cause a denial of service due to an unhandled error and fault isolation.


product: Storage Virtualize

summary: IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker to bypass RPCAdapter endpoint authentication by sending a specifically crafted HTTP request.

title: Ibm Storage Virtualize security vulnerability


summary: IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker with access to the system to execute arbitrary Java code due to improper restrictions in the RPCAdapter service.


product: Security Verify Access

summary: IBM Security Verify Access Appliance 10.0.0.0 through 10.0.0.9 and 11.0.0.0 could allow a local user to execute arbitrary code due to improper restrictions on code generation.

title: Ibm Security Verify Access security vulnerability


product: Aspera Shares

archetype: xxe

summary: IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.


product: Security Verify Access Docker

summary: IBM Security Verify Access Appliance and Docker 10.0 through 10.0.8 could allow a remote attacker to enumerate usernames due to an observable response discrepancy of disabled accounts.


summary: IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data 4.8.4, 4.8.5, and 5.0.0 through 5.2.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.


product: Job Recruitment

vendor: code-projects

vendor: anisha

summary: A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /_parse/_feedback_system.php. The manipulation of the argument person leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


vendor: scriptsbundle

ecosystem: php/wordpress

summary: The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Scriptsbundle Dwt Listing security vulnerability


summary: The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping on the 'sort_by' and 'token' parameters. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

title: Scriptsbundle Dwt - Directory & Listing Wordpress Theme security vulnerability


product: Chat System

summary: A vulnerability, which was classified as critical, was found in code-projects Chat System 1.0. Affected is an unknown function of the file /admin/deleteuser.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability has been found in code-projects Chat System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/deleteroom.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


product: Online Eyewear Shop

vendor: SourceCodester

summary: A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /orders/view_order.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /user/search_result2.php of the component Parameter Handler. The manipulation of the argument search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


product: Online Shop

summary: A vulnerability was found in code-projects Online Shop 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument name/details leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /user/add_cart.php. The manipulation of the argument id/qty leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


product: Javo Core

vendor: javothemes

summary: The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.


product: Fireware OS

vendor: WatchGuard

product: fireware

vendor: watchguard

summary: An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the Web UI.

title: Watchguard Fireware security vulnerability


product: WP Foodbakery

vendor: Chimpstudio

summary: The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.


summary: The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.8. This is due to the plugin not properly validating a user's identity prior to setting the current user and their authentication cookie. This makes it possible for unauthenticated attackers to gain access to a target user's (e.g. administrators) account.


product: danswer-ai/danswer

vendor: danswer-ai

less_than_or_equal: latest

version: unspecified

version_end_including: latest

summary: A vulnerability in danswer-ai/danswer version 0.9.0 allows for denial of service through memory exhaustion. The issue arises from the use of a vulnerable version of the starlette package (<=0.49) via fastapi, which was patched in fastapi version 0.115.3. The vulnerability can be exploited by sending multiple requests to the /auth/saml/callback endpoint, leading to uncontrolled memory consumption and eventual denial of service.


vendor: binary-husky

summary: A stored cross-site scripting (XSS) vulnerability exists in the Latex Proof-Reading Module of binary-husky/gpt_academic version 3.9.0. This vulnerability allows an attacker to inject malicious scripts into the `debug_log.html` file generated by the module. When an admin visits this debug report, the injected scripts can execute, potentially leading to unauthorized actions and data access.


product: langgenius/dify

vendor: langgenius

product: dify

summary: A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests' module instead of the 'ssrf_proxy', leading to an SSRF vulnerability. This issue was fixed in version 0.11.0.


vendor: dify

summary: A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. The vulnerability occurs in the function `vn.get_training_plan_generic(df_information_schema)`, which does not properly sanitize user inputs before executing queries using the Pandas library. This can potentially lead to Remote Code Execution (RCE) if exploited.


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint.

title: Gitlab security vulnerability


product: gradio-app/gradio

vendor: gradio-app

product: gradio

summary: A Denial of Service (DoS) vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users.


product: gaizhenbiao/chuanhuchatgpt

vendor: gaizhenbiao

product: chuanhuchatgpt

summary: A Server-Side Request Forgery (SSRF) vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access the response directly, potentially leading to unauthorized access to internal systems, data theft, service disruption, or further attacks such as port scanning and accessing metadata endpoints.


product: aimhubio/aim

vendor: aimhubio

product: aim

vendor: aimstack

summary: In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large image, leading to a denial of service condition.


summary: In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.


summary: A Denial of Service (DoS) vulnerability exists in the file upload feature of gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users.


product: wandb/openui

vendor: wandb

summary: A stored Cross-site Scripting (XSS) vulnerability exists in the latest version of wandb/openui. The vulnerability is present in the edit HTML functionality, where an attacker can inject malicious scripts. When the modified HTML is shared with another user, the XSS payload executes, potentially leading to the theft of user prompt history and other sensitive information.


product: MGate 5121 Series

vendor: Moxa

product: MGate 5122 Series

product: MGate 5123 Series

summary: A stored Cross-site Scripting (XSS) vulnerability exists in the MGate 5121/5122/5123 Series firmware version v1.0 because of insufficient sanitization and encoding of user input in the "Login Message" functionality. An authenticated attacker with administrative access can exploit this vulnerability to inject malicious scripts that are continuously stored on the device. These scripts are executed when other users access the login page, potentially resulting in unauthorized actions or other impacts, depending on the user's privileges.

title: Moxa Mgate 5121 Series security vulnerability


summary: An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner.

title: Gitlab security vulnerability


vendor: code-projects

summary: A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/del_product.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical has been found in code-projects Point of Sales and Inventory Management System 1.0. This affects an unknown part of the file /user/plist.php. The manipulation of the argument cat leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical was found in code-projects Point of Sales and Inventory Management System 1.0. This vulnerability affects unknown code of the file /user/search.php. The manipulation of the argument name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, has been found in code-projects Point of Sales and Inventory Management System 1.0. This issue affects some unknown processing of the file /user/search_result.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, was found in code-projects Point of Sales and Inventory Management System 1.0. Affected is an unknown function of the file /user/minus_cart.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability has been found in code-projects Point of Sales and Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /user/search_num.php. The manipulation of the argument search leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /user/update_account.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


product: BaNCS

vendor: TCS

summary: A vulnerability was found in TCS BaNCS 10. It has been classified as problematic. This affects an unknown part of the file /REPORTS/REPORTS_SHOW_FILE.jsp. The manipulation of the argument FilePath leads to file inclusion. The real existence of this vulnerability is still doubted at the moment.


product: Student Management System

summary: A vulnerability was found in code-projects Student Management System 1.0. It has been declared as critical. This vulnerability affects the function showSubject1 of the file /config/DbFunction.php. The manipulation of the argument sid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.


product: Online Shoe Store

summary: A vulnerability was found in code-projects Online Shoe Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /details.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical has been found in code-projects Online Shoe Store 1.0. Affected is an unknown function of the file /details2.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability classified as critical was found in code-projects Online Shoe Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/index.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, has been found in code-projects Online Shoe Store 1.0. Affected by this issue is some unknown functionality of the file /function/login.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as critical, was found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /summary.php. The manipulation of the argument tid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


product: WSO2 Identity Server

summary: A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding. A malicious actor can exploit this vulnerability by injecting a crafted payload that is reflected in the server response, enabling the execution of arbitrary JavaScript in the victim's browser. This vulnerability could allow attackers to redirect users to malicious websites, modify the user interface, or exfiltrate data from the browser. However, session-related sensitive cookies are protected using the httpOnly flag, which mitigates the risk of session hijacking.

title: Wso2 Identity Server security vulnerability


product: School Faculty Scheduling System

vendor: Campcodes

vendor: campcodes

summary: A vulnerability has been found in Campcodes School Faculty Scheduling System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in Campcodes School Faculty Scheduling System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/index.php. The manipulation of the argument page leads to file inclusion. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


product: Student Grading System

summary: A vulnerability was found in Campcodes Student Grading System 1.0. It has been classified as critical. This affects an unknown part of the file /view_students.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


product: Project Management System

summary: A vulnerability was found in Campcodes Project Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forms/update_forms.php?action=change_pic2&id=4. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


product: Custom Header Menu

vendor: TMD

summary: A vulnerability was found in TMD Custom Header Menu 4.0.0.1 on OpenCart. It has been rated as problematic. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument headermenu_id leads to sql injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.


vendor: davidanderson

summary: The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.

title: Davidanderson Updraftplus: Wp Backup & Migration Plugin security vulnerability


product: Privileged Remote Access

vendor: BeyondTrust

vendor: beyondtrust

summary: BeyondTrust Privileged Remote Access (PRA) versions prior to 25.1 are vulnerable to a local authentication bypass. A local authenticated attacker can view the connection details of a ShellJump session that was initiated with external tools, allowing unauthorized access to connected sessions.


product: pgAgent

version_type: rpm

product: pgagent

vendor: pgadmin

summary: When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded random number generator is used when generating the directory name, leading to the possibility for a local attacker to pre-create the directory and thus prevent pgAgent from executing jobs, disrupting scheduled tasks.


vendor: Trimble

summary: A vulnerability, which was classified as problematic, has been found in Trimble SPS851 488.01. Affected by this issue is some unknown functionality of the component Receiver Status Identity Tab. The manipulation of the argument System Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability, which was classified as problematic, was found in Trimble SPS851 488.01. This affects an unknown part of the component Ethernet Configuration Menu. The manipulation of the argument Hostname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


product: Protected Folder

vendor: IOBit

summary: A vulnerability has been found in IOBit Protected Folder up to 1.3.0 and classified as problematic. This vulnerability affects the function 0x22200c in the library pffilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


vendor: IObit

summary: A vulnerability was found in IObit Protected Folder up to 13.6.0.5 and classified as problematic. This issue affects the function 0x8001E000/0x8001E004 in the library IUProcessFilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability was found in IObit Protected Folder up to 13.6.0.5. It has been classified as problematic. Affected is the function 0x8001E000/0x8001E00C/0x8001E004/0x8001E010 in the library IURegistryFilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


vendor: Provision-ISR

summary: A vulnerability was found in Provision-ISR SH-4050A-2, SH-4100A-2L(MM), SH-8100A-2L(MM), SH-16200A-2(1U), SH-16200A-5(1U) and NVR5-8200PX up to 20241220. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /server.js. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

title: Provision-Isr Sh-4050A-2 security vulnerability


product: Electronic Archives System

vendor: Tsinghua Unigroup

summary: A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is an unknown functionality of the file /setting/ClassFy/exampleDownload.html. The manipulation of the argument name leads to path traversal: '/../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as problematic, has been found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this issue is the function download of the file /collect/PortV4/downLoad.html. The manipulation of the argument path leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability, which was classified as problematic, was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). This affects an unknown part of the file /Logs/Annals/downLoad.html. The manipulation of the argument path leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


product: Local Storage Todo App

summary: A vulnerability has been found in code-projects Local Storage Todo App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /js-todo-app/index.html. The manipulation of the argument Add leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.


product: Travel Management System

vendor: fabian

summary: A vulnerability, which was classified as critical, has been found in code-projects Travel Management System 1.0. This issue affects some unknown processing of the file /enquiry.php. The manipulation of the argument pid/t1/t2/t3/t4/t5/t6/t7 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.


product: Responsive Hotel Site

summary: A vulnerability, which was classified as critical, was found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file /admin/print.php. The manipulation of the argument pid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.


product: Gym Management System

vendor: Codezips

vendor: codezips

summary: A vulnerability has been found in Codezips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/admin/submit_payments.php. The manipulation of the argument m_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.


product: Blood Bank Management System

summary: A vulnerability was found in Codezips Blood Bank Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /successadmin.php. The manipulation of the argument psw leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.


summary: A vulnerability was found in Codezips Project Management System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/forms/course.php. The manipulation of the argument course_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


product: Generic PCL6 V4 Printer Driver

vendor: Canon Inc.

version: 2.1 and earlier

product: Generic UFR II V4 Printer Driver

product: Generic LIPSLX V4 Printer Driver

summary: Out-of-bounds vulnerability in curve segmentation processing of Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.

title: Canon Inc. Generic Pcl6 V4 Printer Driver security vulnerability


summary: Out-of-bounds vulnerability due to improper memory release during image rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.


summary: Out-of-bounds vulnerability in slope processing during curve rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.


ecosystem: browser

product: firefox

vendor: mozilla

product: thunderbird

summary: The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

title: Mozilla Firefox security vulnerability


summary: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6.


summary: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.


summary: Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.


summary: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.


summary: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6.

title: Mozilla Firefox security vulnerability


summary: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.


summary: When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 134.


summary: When using an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.* *Note: This issue is a different issue from CVE-2025-0244. This vulnerability was fixed in Firefox 134.


summary: Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134 and Thunderbird 134.


product: iNotes

vendor: HCL Software

summary: HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.


product: IEM

vendor: hcltech

summary: HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitive data without authorization.


summary: HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks.


summary: HCL IEM is affected by a concurrent login vulnerability. The application allows multiple concurrent sessions using the same user credentials, which may introduce security risks.


summary: HCL IEM is affected by a password in cleartext vulnerability. Sensitive information is transmitted without adequate protection, potentially exposing it to unauthorized access during transit.


product: HCL Digital Experience

summary: HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. An attacker could intercept and potentially alter communication between two parties.


product: HCL DevOps Deploy / HCL Launch

vendor: hcltechsw

summary: HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements.

title: Hcltechsw Hcl Devops Deploy security vulnerability


summary: HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function.


summary: HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay service.


summary: HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.


summary: HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user.


product: BigFix Modern Client Management

summary: HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.


product: BigFix Mobile

summary: HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.


summary: HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.

title: Hcltech Bigfix Mobile security vulnerability


summary: HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.


product: HCL Traveler

product: traveler

summary: HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messages, debug logs, or responses to user requests.

title: Hcltech Traveler security vulnerability


summary: HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.

title: Hcltech Traveler security vulnerability


product: Compass

version_type: Framework

summary: A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.


product: lunary-ai/lunary

vendor: lunary-ai

product: lunary

vendor: lunary

summary: A stored cross-site scripting (XSS) vulnerability exists in lunary-ai/lunary versions 1.6.7 and earlier. An attacker can inject malicious JavaScript into the SAML IdP XML metadata, which is used to generate the SAML login redirect URL. This URL is then set as the value of `window.location.href` without proper validation or sanitization. This vulnerability allows the attacker to execute arbitrary JavaScript in the context of the user's browser, potentially leading to session hijacking, data theft, or other malicious actions. The issue is fixed in version 1.7.10.


product: Connect Secure

vendor: Ivanti

product: Policy Secure

product: Neurons for ZTA gateways

business_risk: No additional source-verified CVE-specific business impact was established.

uncertainty: The supplied affected-version records conflict with the NVD description: the records mark Policy Secure 22.7R1.2 and ZTA 22.7R2.3 as affected-or-equal, while the NVD description states that versions before those versions are affected.

uncertainty: The retrieved authoritative sources do not provide sufficient detail for a product-specific, inert verification procedure beyond confirming the installed version and reviewing vendor/CISA guidance.

uncertainty: The Ivanti advisory and CISA mitigation page could not be directly retrieved during enrichment, so no additional vendor-specific mitigation or verification details are asserted.

known_ransomware_campaign_use: Known

notes: CISA Mitigation Instructions: https://www.cisa.gov/cisa-mitigation-instructions-CVE-2025-0282 Additional References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0282

required_action: Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.

vendor_project: Ivanti

vulnerability_name: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

vendor: ivanti

summary: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.


summary: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.

title: Ivanti Connect Secure security vulnerability


product: Migrate OS to SSD

vendor: Paragon Software

product: Disk Wiper

product: Paragon Drive Copy

product: Backup and Recovery

product: Hard Disk Manager

product: Partition Manager

vendor: paragon-software

summary: Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to perform privilege escalation exploits.

title: Paragon-Software Paragon Backup & Recovery security vulnerability


product: Drive Copy

summary: Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim machine.


summary: Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation.


summary: Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation.


summary: Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 prior to 17.5.5, from 17.6 prior to 17.6.3, and from 17.7 prior to 17.7.1. Under certain conditions, processing of CI artifacts metadata could cause background jobs to become unresponsive.

title: Gitlab security vulnerability


product: Chrome

vendor: Google

product: chrome

vendor: google

summary: Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability