Recent vulnerabilities

Vulnerabilities are sorted by update time (recent to old).
ID	CVSS	Description	Vendor	Product	Published	Updated
cve-2025-7508		code-projects Modern Bag product-update.php sql injection	code-projects	Modern Bag	2025-07-12T23:32:05.694Z	2025-07-12T23:32:05.694Z
cve-2025-7506		Tenda FH451 HTTP POST Request Natlimit fromNatlimit st…	Tenda	FH451	2025-07-12T23:02:09.735Z	2025-07-12T23:02:09.735Z
cve-2025-7505		Tenda FH451 HTTP POST Request L7Prot frmL7ProtForm sta…	Tenda	FH451	2025-07-12T22:32:07.315Z	2025-07-12T22:32:07.315Z
cve-2025-7492		PHPGurukul Vehicle Parking Management System manage-in…	PHPGurukul	Vehicle Parking Management System	2025-07-12T21:32:06.610Z	2025-07-12T21:32:06.610Z
cve-2025-7491		PHPGurukul Vehicle Parking Management System manage-ou…	PHPGurukul	Vehicle Parking Management System	2025-07-12T21:02:06.181Z	2025-07-12T21:02:06.181Z
cve-2025-7490		PHPGurukul Vehicle Parking Management System reg-users…	PHPGurukul	Vehicle Parking Management System	2025-07-12T20:32:06.518Z	2025-07-12T20:32:06.518Z
cve-2025-7489		PHPGurukul Vehicle Parking Management System search-ve…	PHPGurukul	Vehicle Parking Management System	2025-07-12T20:02:06.445Z	2025-07-12T20:02:06.445Z
cve-2025-7488		JoeyBling SpringBoot_MyBatisPlus download path traversal	JoeyBling	SpringBoot_MyBatisPlus	2025-07-12T19:32:05.595Z	2025-07-12T19:32:05.595Z
cve-2025-7487		JoeyBling SpringBoot_MyBatisPlus upload SysFileControl…	JoeyBling	SpringBoot_MyBatisPlus	2025-07-12T19:02:05.776Z	2025-07-12T19:02:05.776Z
cve-2025-7485		Open5GS SCTP Partial Message recv_handler assertion	n/a	Open5GS	2025-07-12T18:32:07.219Z	2025-07-12T18:32:07.219Z
cve-2025-7484		PHPGurukul Vehicle Parking Management System view-outg…	PHPGurukul	Vehicle Parking Management System	2025-07-12T18:02:06.159Z	2025-07-12T18:02:06.159Z
cve-2025-7483		PHPGurukul Vehicle Parking Management System forgot-pa…	PHPGurukul	Vehicle Parking Management System	2025-07-12T17:32:06.887Z	2025-07-12T17:32:06.887Z
cve-2025-7482		PHPGurukul Vehicle Parking Management System print.php…	PHPGurukul	Vehicle Parking Management System	2025-07-12T17:02:06.682Z	2025-07-12T17:02:06.682Z
cve-2025-7481		PHPGurukul Vehicle Parking Management System profile.p…	PHPGurukul	Vehicle Parking Management System	2025-07-12T16:32:06.399Z	2025-07-12T16:32:06.399Z
cve-2024-41169		Apache Zeppelin: raft directory listing and file read	Apache Software Foundation	Apache Zeppelin	2025-07-12T16:22:35.724Z	2025-07-12T16:22:35.724Z
cve-2025-7480		PHPGurukul Vehicle Parking Management System signup.ph…	PHPGurukul	Vehicle Parking Management System	2025-07-12T16:02:06.782Z	2025-07-12T16:02:06.782Z
cve-2025-7479		PHPGurukul Vehicle Parking Management System view--det…	PHPGurukul	Vehicle Parking Management System	2025-07-12T15:32:06.334Z	2025-07-12T15:32:06.334Z
cve-2025-7478		code-projects Modern Bag category-list.php sql injection	code-projects	Modern Bag	2025-07-12T15:02:06.132Z	2025-07-12T15:02:06.132Z
cve-2025-7477		code-projects Simple Car Rental System add_cars.php un…	code-projects	Simple Car Rental System	2025-07-12T14:32:05.913Z	2025-07-12T14:32:05.913Z
cve-2025-7476		code-projects Simple Car Rental System approve.php sql…	code-projects	Simple Car Rental System	2025-07-12T13:32:04.987Z	2025-07-12T13:32:04.987Z
cve-2025-7475		code-projects Simple Car Rental System pay.php sql injection	code-projects	Simple Car Rental System	2025-07-12T12:32:05.947Z	2025-07-12T12:32:05.947Z
cve-2025-7474		code-projects Job Diary search.php sql injection	code-projects	Job Diary	2025-07-12T12:02:05.906Z	2025-07-12T12:02:05.906Z
cve-2025-7471		code-projects Modern Bag login-back.php sql injection	code-projects	Modern Bag	2025-07-12T11:32:05.843Z	2025-07-12T11:32:05.843Z
cve-2025-36104	6.5 (v3.1)	IBM Storage Scale information disclosure	IBM	Storage Scale	2025-07-12T11:30:41.359Z	2025-07-12T11:30:41.359Z
cve-2020-36849		AIT CSV import/export <= 3.0.3 - Unauthenticated Arbit…	AIT Themes	AIT CSV import/export	2025-07-12T11:23:40.285Z	2025-07-12T11:23:40.285Z
cve-2021-4458		Modern Events Calendar Lite <= 6.3.0 - Unauthenticated…	webnus/	Modern Events Calendar Lite	2025-07-12T11:23:39.379Z	2025-07-12T11:23:39.379Z
cve-2020-36848		Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated B…	boldgrid	Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid	2025-07-12T11:23:39.932Z	2025-07-12T11:23:39.932Z
cve-2025-7518		RSFirewall! <= 1.1.42 - Authenticated (Admin+) Arbitra…	rsjoomla	RSFirewall!	2025-07-12T09:24:28.763Z	2025-07-12T09:24:28.763Z
cve-2020-36847		Simple File List < 4.2.3 - Remote Code Execution	eemitch	Simple File List	2025-07-12T09:24:28.215Z	2025-07-12T09:24:28.215Z
cve-2025-7468		Tenda FH1201 HTTP POST Request fromSafeUrlFilter buffe…	Tenda	FH1201	2025-07-12T09:02:06.642Z	2025-07-12T09:02:06.642Z

Vulnerabilities are sorted by update time (recent to old).
ID	CVSS	Description	Vendor	Product	Published	Updated
cve-2025-7481		PHPGurukul Vehicle Parking Management System profile.p…	PHPGurukul	Vehicle Parking Management System	2025-07-12T16:32:06.399Z	2025-07-12T16:32:06.399Z
cve-2024-41169		Apache Zeppelin: raft directory listing and file read	Apache Software Foundation	Apache Zeppelin	2025-07-12T16:22:35.724Z	2025-07-12T16:22:35.724Z
cve-2025-7480		PHPGurukul Vehicle Parking Management System signup.ph…	PHPGurukul	Vehicle Parking Management System	2025-07-12T16:02:06.782Z	2025-07-12T16:02:06.782Z
cve-2025-7479		PHPGurukul Vehicle Parking Management System view--det…	PHPGurukul	Vehicle Parking Management System	2025-07-12T15:32:06.334Z	2025-07-12T15:32:06.334Z
cve-2025-7478		code-projects Modern Bag category-list.php sql injection	code-projects	Modern Bag	2025-07-12T15:02:06.132Z	2025-07-12T15:02:06.132Z
cve-2025-7477		code-projects Simple Car Rental System add_cars.php un…	code-projects	Simple Car Rental System	2025-07-12T14:32:05.913Z	2025-07-12T14:32:05.913Z
cve-2025-7476		code-projects Simple Car Rental System approve.php sql…	code-projects	Simple Car Rental System	2025-07-12T13:32:04.987Z	2025-07-12T13:32:04.987Z
cve-2025-7475		code-projects Simple Car Rental System pay.php sql injection	code-projects	Simple Car Rental System	2025-07-12T12:32:05.947Z	2025-07-12T12:32:05.947Z
cve-2025-7474		code-projects Job Diary search.php sql injection	code-projects	Job Diary	2025-07-12T12:02:05.906Z	2025-07-12T12:02:05.906Z
cve-2025-7471		code-projects Modern Bag login-back.php sql injection	code-projects	Modern Bag	2025-07-12T11:32:05.843Z	2025-07-12T11:32:05.843Z
cve-2025-36104	6.5 (v3.1)	IBM Storage Scale information disclosure	IBM	Storage Scale	2025-07-12T11:30:41.359Z	2025-07-12T11:30:41.359Z
cve-2021-4458		Modern Events Calendar Lite <= 6.3.0 - Unauthenticated…	webnus/	Modern Events Calendar Lite	2025-07-12T11:23:39.379Z	2025-07-12T11:23:39.379Z
cve-2020-36849		AIT CSV import/export <= 3.0.3 - Unauthenticated Arbit…	AIT Themes	AIT CSV import/export	2025-07-12T11:23:40.285Z	2025-07-12T11:23:40.285Z
cve-2020-36848		Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated B…	boldgrid	Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid	2025-07-12T11:23:39.932Z	2025-07-12T11:23:39.932Z
cve-2025-7470		Campcodes Sales and Inventory System product_add.php u…	Campcodes	Sales and Inventory System	2025-07-12T11:02:05.895Z	2025-07-13T14:54:01.260Z
cve-2025-7469		Campcodes Sales and Inventory System product_add.php s…	Campcodes	Sales and Inventory System	2025-07-12T10:32:06.422Z	2025-07-13T14:54:16.580Z
cve-2025-7518		RSFirewall! <= 1.1.42 - Authenticated (Admin+) Arbitra…	rsjoomla	RSFirewall!	2025-07-12T09:24:28.763Z	2025-07-12T09:24:28.763Z
cve-2020-36847		Simple File List < 4.2.3 - Remote Code Execution	eemitch	Simple File List	2025-07-12T09:24:28.215Z	2025-07-12T09:24:28.215Z
cve-2025-7504		Friends 3.5.1 - Authenticated (Subscriber+) PHP Object…	akirk	Friends	2025-07-12T08:23:42.188Z	2025-07-12T08:23:42.188Z
cve-2025-7468		Tenda FH1201 HTTP POST Request fromSafeUrlFilter buffe…	Tenda	FH1201	2025-07-12T09:02:06.642Z	2025-07-12T09:02:06.642Z
cve-2025-7467		code-projects Modern Bag product-detail.php sql injection	code-projects	Modern Bag	2025-07-12T08:32:06.032Z	2025-07-12T08:32:06.032Z
cve-2025-7466		1000projects ABC Courier Management add_dealerrequest.…	1000projects	ABC Courier Management	2025-07-12T08:02:05.310Z	2025-07-12T08:02:05.310Z
cve-2025-6423		BeeTeam368 Extensions <= 2.3.5 - Authenticated (Subscr…	beeteam368	BeeTeam368 Extensions	2025-07-12T07:24:24.664Z	2025-07-12T07:24:24.664Z
cve-2025-7465		Tenda FH1201 HTTP POST Request fromRouteStatic buffer …	Tenda	FH1201	2025-07-12T07:02:07.562Z	2025-07-12T07:02:07.562Z
cve-2025-7464		osrg GoBGP rtr.go SplitRTR out-of-bounds	osrg	GoBGP	2025-07-12T06:32:06.030Z	2025-07-12T06:32:06.030Z
cve-2025-7463		Tenda FH1201 HTTP POST Request AdvSetWrlsafeset formWr…	Tenda	FH1201	2025-07-12T06:02:06.537Z	2025-07-12T06:02:06.537Z
cve-2025-7462		Artifex GhostPDL New Output File Open Error gdevpdf.c …	Artifex	GhostPDL	2025-07-12T05:32:09.177Z	2025-07-12T05:32:09.177Z
cve-2025-1313		Nokri - Job Board WordPress Theme <= 1.6.3 - Authentic…	scriptsbundle	Nokri – Job Board WordPress Theme	2025-07-12T05:30:11.949Z	2025-07-12T05:30:11.949Z
cve-2025-7461		code-projects Modern Bag action.php sql injection	code-projects	Modern Bag	2025-07-12T04:32:06.241Z	2025-07-12T04:32:06.241Z
cve-2025-6058		WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload	iqonicdesign	WPBookit	2025-07-12T04:22:21.429Z	2025-07-12T04:22:21.429Z

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
fkie_cve-2020-36849	The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missi…	2025-07-12T12:15:25.570	2025-07-12T12:15:25.570
fkie_cve-2020-36848	The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress …	2025-07-12T12:15:24.897	2025-07-12T12:15:24.897
fkie_cve-2025-7470	A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as cr…	2025-07-12T11:15:25.473	2025-07-12T11:15:25.473
fkie_cve-2025-7469	A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. T…	2025-07-12T11:15:24.507	2025-07-12T11:15:24.507
fkie_cve-2025-7518	The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and inc…	2025-07-12T10:15:26.217	2025-07-12T10:15:26.217
fkie_cve-2020-36847	The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to,…	2025-07-12T10:15:24.770	2025-07-12T10:15:24.770
fkie_cve-2025-7504	The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deseria…	2025-07-12T09:15:26.187	2025-07-12T09:15:26.187
fkie_cve-2025-7468	A vulnerability has been found in Tenda FH1201 1.2.0.14 and classified as critical. This vulnerabil…	2025-07-12T09:15:25.950	2025-07-12T09:15:25.950
fkie_cve-2025-7467	A vulnerability, which was classified as critical, was found in code-projects Modern Bag 1.0. This …	2025-07-12T09:15:25.187	2025-07-12T09:15:25.187
fkie_cve-2025-7466	A vulnerability, which was classified as critical, has been found in 1000projects ABC Courier Manag…	2025-07-12T08:15:24.440	2025-07-12T08:15:24.440
fkie_cve-2025-6423	The BeeTeam368 Extensions plugin for WordPress is vulnerable to arbitrary file uploads due to missi…	2025-07-12T08:15:23.367	2025-07-12T08:15:23.367
fkie_cve-2025-7465	A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14. Affected by this vulnera…	2025-07-12T07:15:23.240	2025-07-12T07:15:23.240
fkie_cve-2025-7464	A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is th…	2025-07-12T07:15:22.950	2025-07-12T07:15:22.950
fkie_cve-2025-7463	A vulnerability was found in Tenda FH1201 1.2.0.14. It has been declared as critical. This vulnerab…	2025-07-12T06:15:21.430	2025-07-12T06:15:21.430
fkie_cve-2025-7462	A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It ha…	2025-07-12T06:15:21.200	2025-07-12T06:15:21.200
fkie_cve-2025-1313	The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via…	2025-07-12T06:15:20.820	2025-07-12T06:15:20.820
fkie_cve-2025-7461	A vulnerability was found in code-projects Modern Bag 1.0 and classified as critical. Affected by t…	2025-07-12T05:15:22.540	2025-07-12T05:15:22.540
fkie_cve-2025-6058	The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type …	2025-07-12T05:15:22.387	2025-07-12T05:15:22.387
fkie_cve-2025-6057	The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type …	2025-07-12T05:15:21.223	2025-07-12T05:15:21.223
fkie_cve-2025-24294	The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insuffi…	2025-07-12T04:15:46.683	2025-07-12T04:15:46.683
fkie_cve-2024-38648	A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent netw…	2025-07-12T04:15:46.313	2025-07-12T04:15:46.313
fkie_cve-2023-39339	A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated …	2025-07-12T04:15:46.107	2025-07-12T04:15:46.107
fkie_cve-2023-39338	Enables an authenticated user (enrolled device) to access a service protected by Sentry even if the…	2025-07-12T04:15:45.777	2025-07-12T04:15:45.777
fkie_cve-2023-38036	A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthen…	2025-07-12T04:15:27.163	2025-07-12T04:15:27.163
fkie_cve-2025-53879	Rejected reason: Not used	2025-07-12T03:15:21.570	2025-07-12T03:15:21.570
fkie_cve-2025-53878	Rejected reason: Not used	2025-07-12T03:15:21.510	2025-07-12T03:15:21.510
fkie_cve-2025-53877	Rejected reason: Not used	2025-07-12T03:15:21.447	2025-07-12T03:15:21.447
fkie_cve-2025-53876	Rejected reason: Not used	2025-07-12T03:15:21.390	2025-07-12T03:15:21.390
fkie_cve-2025-53875	Rejected reason: Not used	2025-07-12T03:15:21.323	2025-07-12T03:15:21.323
fkie_cve-2025-53874	Rejected reason: Not used	2025-07-12T03:15:21.260	2025-07-12T03:15:21.260

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
ghsa-gcj4-979g-33cw	The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' pa…	2025-07-12T12:30:20Z	2025-07-12T12:30:20Z
ghsa-f6pp-29jv-qvgx	The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and inc…	2025-07-12T12:30:20Z	2025-07-12T12:30:20Z
ghsa-4j28-7h3p-cv76	A vulnerability was found in code-projects Modern Bag 1.0. It has been declared as critical. Affect…	2025-07-12T12:30:20Z	2025-07-12T12:30:20Z
ghsa-34hm-qhxq-8vfv	The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to,…	2025-07-12T12:30:20Z	2025-07-12T12:30:20Z
ghsa-25gv-jrjg-43pj	A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as cr…	2025-07-12T12:30:20Z	2025-07-12T12:30:20Z
ghsa-fq9g-vv96-g2vc	A vulnerability, which was classified as critical, was found in code-projects Modern Bag 1.0. This …	2025-07-12T09:30:31Z	2025-07-12T09:30:31Z
ghsa-56rg-32wr-38cm	A vulnerability has been found in Tenda FH1201 1.2.0.14 and classified as critical. This vulnerabil…	2025-07-12T09:30:31Z	2025-07-12T09:30:31Z
ghsa-4fh8-fjgg-4q2v	The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deseria…	2025-07-12T09:30:31Z	2025-07-12T09:30:31Z
ghsa-vwjp-r23f-3f37	A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is th…	2025-07-12T09:30:30Z	2025-07-12T09:30:30Z
ghsa-qqx8-c7mj-52mh	The BeeTeam368 Extensions plugin for WordPress is vulnerable to arbitrary file uploads due to missi…	2025-07-12T09:30:30Z	2025-07-12T09:30:30Z
ghsa-g7jg-vxf2-648c	A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14. Affected by this vulnera…	2025-07-12T09:30:30Z	2025-07-12T09:30:30Z
ghsa-2f6j-4278-g35p	A vulnerability, which was classified as critical, has been found in 1000projects ABC Courier Manag…	2025-07-12T09:30:30Z	2025-07-12T09:30:30Z
ghsa-mghx-6f4q-jcrv	The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via…	2025-07-12T06:30:23Z	2025-07-12T06:30:23Z
ghsa-hf2c-wp2p-xqr9	A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It ha…	2025-07-12T06:30:23Z	2025-07-12T06:30:23Z
ghsa-f7v2-34w5-rp4f	A vulnerability was found in Tenda FH1201 1.2.0.14. It has been declared as critical. This vulnerab…	2025-07-12T06:30:23Z	2025-07-12T06:30:23Z
ghsa-7jcv-9pmx-59g2	A vulnerability was found in code-projects Modern Bag 1.0 and classified as critical. Affected by t…	2025-07-12T06:30:23Z	2025-07-12T06:30:23Z
ghsa-68fc-7cx8-5rmc	The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type …	2025-07-12T06:30:23Z	2025-07-12T06:30:23Z
ghsa-3554-wwhq-78h4	The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type …	2025-07-12T06:30:23Z	2025-07-12T06:30:23Z
ghsa-whgg-c8ff-264h	A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated …	2025-07-12T06:30:22Z	2025-07-12T06:30:22Z
ghsa-rmcg-3298-c99g	A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthen…	2025-07-12T06:30:22Z	2025-07-12T06:30:22Z
ghsa-94xh-prxv-w7r3	Enables an authenticated user (enrolled device) to access a service protected by Sentry even if the…	2025-07-12T06:30:22Z	2025-07-12T06:30:22Z
ghsa-8vv2-mwjj-9vr6	A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent netw…	2025-07-12T06:30:22Z	2025-07-12T06:30:22Z
ghsa-q7fp-768h-f255	Rejected reason: Not used	2025-07-12T03:30:20Z	2025-07-12T03:30:20Z
ghsa-hv67-cj9h-2798	Rejected reason: Not used	2025-07-12T03:30:20Z	2025-07-12T03:30:20Z
ghsa-f44q-pqw8-vmcf	Rejected reason: Not used	2025-07-12T03:30:20Z	2025-07-12T03:30:20Z
ghsa-6vf8-jwjq-h6x6	Rejected reason: Not used	2025-07-12T03:30:20Z	2025-07-12T03:30:20Z
ghsa-6r3p-w2xm-3gqx	Rejected reason: Not used	2025-07-12T03:30:20Z	2025-07-12T03:30:20Z
ghsa-5rxw-qq5w-mwpp	Rejected reason: Not used	2025-07-12T03:30:20Z	2025-07-12T03:30:20Z
ghsa-57mq-cq9r-9vrh	Rejected reason: Not used	2025-07-12T03:30:20Z	2025-07-12T03:30:20Z
ghsa-3qw7-pprw-qgj4	Rejected reason: Not used	2025-07-12T03:30:20Z	2025-07-12T03:30:20Z

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Package	Published	Updated
pysec-2025-29	vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the …	vyper	2025-02-21T22:15:13+00:00	2025-04-09T17:27:28.005382+00:00
pysec-2025-28	The Snowflake Connector for Python provides an interface for developing Python applicatio…	snowflake-connector-python	2025-01-29T21:15:21+00:00	2025-04-09T17:27:27.772920+00:00
pysec-2025-27	The Snowflake Connector for Python provides an interface for developing Python applicatio…	snowflake-connector-python	2025-01-29T21:15:21+00:00	2025-04-09T17:27:27.711157+00:00
pysec-2025-26	The Snowflake Connector for Python provides an interface for developing Python applicatio…	snowflake-connector-python	2025-01-29T21:15:21+00:00	2025-04-09T17:27:27.645758+00:00
pysec-2021-891	CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 S…	salt	2021-03-03T10:15:13+00:00	2025-04-09T17:27:27.582884+00:00
pysec-2025-25	Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middle…	rembg	2025-03-03T17:15:14+00:00	2025-04-09T17:27:27.532849+00:00
pysec-2025-24	Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove…	rembg	2025-03-03T17:15:14+00:00	2025-04-09T17:27:27.486485+00:00
pysec-2025-23	Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Inform…	ray	2025-03-06T05:15:16+00:00	2025-04-09T17:27:27.434099+00:00
pysec-2022-43179	Poetry is a dependency manager for Python. To handle dependencies that come from a Git re…	poetry	2022-09-07T19:15:08+00:00	2025-04-09T17:27:27.255151+00:00
pysec-2025-22	A vulnerability, that could result in Remote Code Execution (RCE), has been found in Plot…	plotai	2025-03-10T14:15:24+00:00	2025-04-09T17:27:27.203714+00:00
pysec-2023-311	plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depen…	plone-namedfile	2023-09-21T15:15:10+00:00	2025-04-09T17:27:27.153848+00:00
pysec-2025-21	picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model arch…	picklescan	2025-03-10T12:15:12+00:00	2025-04-09T17:27:27.016747+00:00
pysec-2025-20	picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes i…	picklescan	2025-03-10T12:15:10+00:00	2025-04-09T17:27:26.966215+00:00
pysec-2025-19	picklescan before 0.0.22 only considers standard pickle file extensions in the scope for …	picklescan	2025-03-03T19:15:34+00:00	2025-04-09T17:27:26.916350+00:00
pysec-2025-18	picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craf…	picklescan	2025-02-26T15:15:24+00:00	2025-04-09T17:27:26.867210+00:00
pysec-2023-310	Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NO…	mobsf	2023-09-21T22:15:11+00:00	2025-04-09T17:27:26.663665+00:00
pysec-2025-17	In mlflow/mlflow version 2.18, an admin is able to create a new user account without sett…	mlflow	2025-03-20T10:15:54+00:00	2025-04-09T17:27:26.322333+00:00
pysec-2023-309	Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.	mlflow	2023-12-13T00:15:07+00:00	2025-04-09T17:27:26.271200+00:00
pysec-2023-308	Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.	mlflow	2023-07-19T01:15:10+00:00	2025-04-09T17:27:26.223213+00:00
pysec-2025-16	LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vu…	lnbits	2025-04-06T20:15:15+00:00	2025-04-09T17:27:25.872691+00:00
pysec-2025-15	Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilde…	flask-appbuilder	2025-03-03T16:15:41+00:00	2025-04-09T17:27:25.227116+00:00
pysec-2025-14	An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normal…	django	2025-04-02T13:15:44+00:00	2025-04-09T17:27:25.169049+00:00
pysec-2025-13	An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2…	django	2025-03-06T19:15:27+00:00	2025-04-09T17:27:25.095679+00:00
pysec-2022-43178	An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo …	cleo	2022-11-09T20:15:10+00:00	2025-04-09T17:27:24.793038+00:00
pysec-2022-43177	Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40…	azure-cli	2022-10-25T17:15:56+00:00	2025-04-09T17:27:24.642962+00:00
pysec-2024-244	A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a by…	mlflow	2024-05-16T09:15:14+00:00	2025-04-08T10:23:25.092581+00:00
pysec-2024-243	mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs…	mlflow	2024-04-16T00:15:12+00:00	2025-04-08T10:23:25.044416+00:00
pysec-2024-242	A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically …	mlflow	2024-06-06T19:15:55+00:00	2025-04-08T10:23:24.995743+00:00
pysec-2024-241	Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untru…	mlflow	2024-02-23T22:15:55+00:00	2025-04-08T10:23:24.946136+00:00
pysec-2024-240	Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This …	mlflow	2024-02-23T22:15:55+00:00	2025-04-08T10:23:24.900947+00:00

Vulnerabilities are sorted by update time (recent to old).
ID	Description
gsd-2024-33851	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33850	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33849	The format of the source doesn't require a description, click on the link for more details
gsd-2024-4295	The format of the source doesn't require a description, click on the link for more details
gsd-2024-4294	The format of the source doesn't require a description, click on the link for more details
gsd-2024-4293	The format of the source doesn't require a description, click on the link for more details
gsd-2024-4292	The format of the source doesn't require a description, click on the link for more details
gsd-2024-4291	The format of the source doesn't require a description, click on the link for more details
gsd-2023-52722	The format of the source doesn't require a description, click on the link for more details
gsd-2022-48685	The format of the source doesn't require a description, click on the link for more details
gsd-2022-48684	The format of the source doesn't require a description, click on the link for more details
gsd-2024-24777	The format of the source doesn't require a description, click on the link for more details
gsd-2024-28875	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33846	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33845	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33844	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33843	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33842	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33841	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33840	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33839	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33838	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33837	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33836	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33835	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33834	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33833	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33832	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33831	The format of the source doesn't require a description, click on the link for more details
gsd-2024-33830	The format of the source doesn't require a description, click on the link for more details

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
mal-2024-1223	Malicious code in @lbnqduy11805/musical-doodle (npm)	2024-04-10T05:55:21Z	2024-04-10T05:55:22Z
mal-2024-1222	Malicious code in @lbnqduy11805/miniature-train (npm)	2024-04-10T05:55:21Z	2024-04-10T05:55:22Z
mal-2024-1221	Malicious code in @lbnqduy11805/miniature-garbanzo (npm)	2024-04-10T05:55:21Z	2024-04-10T05:55:22Z
mal-2024-1220	Malicious code in @lbnqduy11805/legendary-octo-carnival (npm)	2024-04-10T05:55:21Z	2024-04-10T05:55:22Z
mal-2024-1215	Malicious code in @lbnqduy11805/congenial-dollop (npm)	2024-04-10T05:55:21Z	2024-04-10T05:55:22Z
mal-2024-1244	Malicious code in @lbnqduy11805/urban-octo-adventure (npm)	2024-04-10T05:55:21Z	2024-04-10T05:55:21Z
mal-2024-1241	Malicious code in @lbnqduy11805/sturdy-waddle (npm)	2024-04-10T05:55:21Z	2024-04-10T05:55:21Z
mal-2024-1238	Malicious code in @lbnqduy11805/stunning-fishstick (npm)	2024-04-10T05:55:21Z	2024-04-10T05:55:21Z
mal-2024-1237	Malicious code in @lbnqduy11805/studious-octo-waddle (npm)	2024-04-10T05:55:20Z	2024-04-10T05:55:21Z
mal-2024-1235	Malicious code in @lbnqduy11805/special-palm-tree (npm)	2024-04-10T05:55:21Z	2024-04-10T05:55:21Z
mal-2024-1229	Malicious code in @lbnqduy11805/refactored-eureka (npm)	2024-04-10T05:55:21Z	2024-04-10T05:55:21Z
mal-2024-1218	Malicious code in @lbnqduy11805/friendly-doodle (npm)	2024-04-10T05:55:21Z	2024-04-10T05:55:21Z
mal-2024-1217	Malicious code in @lbnqduy11805/expert-waddle (npm)	2024-04-10T05:55:20Z	2024-04-10T05:55:21Z
mal-2024-1236	Malicious code in @lbnqduy11805/studious-memory (npm)	2024-04-10T05:55:20Z	2024-04-10T05:55:20Z
mal-2024-1234	Malicious code in @lbnqduy11805/special-funicular (npm)	2024-04-10T05:55:20Z	2024-04-10T05:55:20Z
mal-2024-1231	Malicious code in @lbnqduy11805/reimagined-happiness (npm)	2024-04-10T05:55:20Z	2024-04-10T05:55:20Z
mal-2024-1228	Malicious code in @lbnqduy11805/redesigned-journey (npm)	2024-04-10T05:55:20Z	2024-04-10T05:55:20Z
mal-2024-1226	Malicious code in @lbnqduy11805/psychic-journey (npm)	2024-04-10T05:55:19Z	2024-04-10T05:55:20Z
mal-2024-1214	Malicious code in @lbnqduy11805/cautious-octo-rotary-phone (npm)	2024-04-10T05:55:19Z	2024-04-10T05:55:20Z
mal-2024-1212	Malicious code in @lbnqduy11805/animated-doodle (npm)	2024-04-10T05:55:20Z	2024-04-10T05:55:20Z
mal-2024-1219	Malicious code in @lbnqduy11805/ideal-octo-spork (npm)	2024-04-10T05:55:19Z	2024-04-10T05:55:19Z
mal-2024-1252	Malicious code in test-npm-lifecycle (npm)	2024-04-10T03:56:53Z	2024-04-10T03:56:53Z
mal-2024-1251	Malicious code in shuaishuaiqiang (npm)	2024-04-10T03:56:53Z	2024-04-10T03:56:53Z
mal-2024-1250	Malicious code in shuaishuai (npm)	2024-04-10T03:56:53Z	2024-04-10T03:56:53Z
mal-2024-1249	Malicious code in shuaiqiang (npm)	2024-04-10T03:56:53Z	2024-04-10T03:56:53Z
mal-2024-1248	Malicious code in benjimain (npm)	2024-04-10T03:56:53Z	2024-04-10T03:56:53Z
mal-2024-1247	Malicious code in @sber-site/sbercraft-nova-kit (npm)	2024-04-10T03:45:28Z	2024-04-10T03:45:28Z
mal-2024-1246	Malicious code in @sber-sd/assistant-web-sdk (npm)	2024-04-10T03:45:10Z	2024-04-10T03:45:10Z
mal-2024-1211	Malicious code in tokenaddress (npm)	2024-04-08T07:22:55Z	2024-04-08T07:22:55Z
mal-2024-1210	Malicious code in recxn-logs (npm)	2024-04-08T07:16:13Z	2024-04-08T07:16:14Z

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
wid-sec-w-2025-1378	Red Hat Enterprise Linux (mod_proxy_cluster): Schwachstelle ermöglicht Manipulation von Daten	2025-06-23T22:00:00.000+00:00	2025-06-25T22:00:00.000+00:00
wid-sec-w-2025-0679	Golang Go: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen	2025-04-01T22:00:00.000+00:00	2025-06-25T22:00:00.000+00:00
wid-sec-w-2025-0649	Linux Kernel: Mehrere Schwachstellen	2025-03-27T23:00:00.000+00:00	2025-06-25T22:00:00.000+00:00
wid-sec-w-2025-0499	Linux Kernel: Mehrere Schwachstellen	2025-03-06T23:00:00.000+00:00	2025-06-25T22:00:00.000+00:00
wid-sec-w-2025-1308	Mitel MiCollab: Schwachstelle ermöglicht Offenlegung von Informationen und Administrative Zugriffe	2025-06-11T22:00:00.000+00:00	2025-06-24T22:00:00.000+00:00
wid-sec-w-2025-0233	Python: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen	2025-02-02T23:00:00.000+00:00	2025-06-24T22:00:00.000+00:00
wid-sec-w-2024-3728	Golang Go (x/net/html): Schwachstelle ermöglicht Denial of Service	2024-12-18T23:00:00.000+00:00	2025-06-24T22:00:00.000+00:00
wid-sec-w-2025-1369	Red Hat Enterprise Linux (mpfr): Schwachstelle ermöglicht Denial of Service	2025-06-22T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1368	IBM Spectrum Protect: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen	2025-06-22T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1367	IBM InfoSphere Information Server: Mehrere Schwachstellen	2025-06-22T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1366	F5 BIG-IP: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen	2025-06-22T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1362	ClamAV: Mehrere Schwachstellen ermöglichen Denial of Service	2025-06-19T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1340	Google Chrome und Microsoft Edge: Mehrere Schwachstellen	2025-06-17T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1318	Python: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen	2025-06-12T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1280	Intel Firmware: Schwachstelle ermöglicht Denial of Service	2025-06-10T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1278	AMD Prozessoren: Schwachstelle ermöglicht Denial of Service und Offenlegung von Informationen	2025-06-10T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1258	KDE "Konsole": Schwachstelle ermöglicht Codeausführung	2025-06-09T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1252	GNU libc: Mehrere Schwachstellen ermöglichen Manipulation von Daten	2025-06-05T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1231	Python: Mehrere Schwachstellen	2025-06-03T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1215	OWASP ModSecurity: Schwachstelle ermöglicht Denial of Service	2025-06-02T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1206	Perl: Schwachstelle ermöglicht Codeausführung und Offenlegung von Informationen	2025-06-01T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1171	GStreamer: Mehrere Schwachstellen	2025-05-29T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1167	IBM DB2: Mehrere Schwachstellen	2025-05-29T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1158	Google Chrome / Microsoft Edge: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff	2025-05-27T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1144	GIMP: Mehrere Schwachstellen ermöglichen Codeausführung	2025-05-25T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1118	OWASP ModSecurity: Schwachstelle ermöglicht Denial of Service	2025-05-21T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1089	GNU libc: Schwachstelle ermöglicht Codeausführung	2025-05-18T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1055	Node.js: Mehrere Schwachstellen	2025-05-14T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-1050	Microsoft Windows Server: Mehrere Schwachstellen ermöglichen Privilegieneskalation	2025-05-13T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00
wid-sec-w-2025-0944	GIMP: Schwachstelle ermöglicht Codeausführung	2025-05-05T22:00:00.000+00:00	2025-06-22T22:00:00.000+00:00

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
ncsc-2025-0169	Kwetsbaarheden verholpen in Google Chrome	2025-05-16T12:41:47.685095Z	2025-05-16T12:41:47.685095Z
ncsc-2025-0152	Kwetsbaarheden verholpen in Ivanti Endpoint Manager Mobile (EPMM, voormalig MobileIron)	2025-05-13T15:35:45.784542Z	2025-05-16T09:42:15.822544Z
ncsc-2025-0168	Kwetsbaarheid verholpen in FortiVoice	2025-05-14T13:50:54.001151Z	2025-05-14T13:50:54.001151Z
ncsc-2025-0167	Kwetsbaarheden verholpen in Zoho ManageEngine	2025-05-14T13:19:58.768414Z	2025-05-14T13:19:58.768414Z
ncsc-2025-0166	Kwetsbaarheden verholpen in Fortinet producten	2025-05-14T08:41:08.980708Z	2025-05-14T08:41:08.980708Z
ncsc-2025-0165	Kwetsbaarheid verholpen in Adobe Illustrator	2025-05-14T08:25:17.869407Z	2025-05-14T08:25:17.869407Z
ncsc-2025-0164	Kwetsbaarheden verholpen in Adobe Photoshop	2025-05-14T08:24:02.186984Z	2025-05-14T08:24:02.186984Z
ncsc-2025-0163	Kwetsbaarheden verholpen in Adobe Animate	2025-05-14T08:21:49.917725Z	2025-05-14T08:21:49.917725Z
ncsc-2025-0162	Kwetsbaarheden verholpen in Adobe ColdFusion	2025-05-14T08:18:54.775740Z	2025-05-14T08:18:54.775740Z
ncsc-2025-0161	Kwetsbaarheid verholpen in Ivanti Neurons for ITSM	2025-05-14T08:16:04.867590Z	2025-05-14T08:16:04.867590Z
ncsc-2025-0160	Kwetsbaarheden verholpen in Siemens producten	2025-05-14T07:13:32.957900Z	2025-05-14T07:13:32.957900Z
ncsc-2025-0159	Kwetsbaarheden verholpen in Microsoft Windows	2025-05-13T19:47:12.555983Z	2025-05-13T19:47:12.555983Z
ncsc-2025-0158	Kwetsbaarheden verholpen in Microsoft Edge	2025-05-13T19:17:52.478234Z	2025-05-13T19:17:52.478234Z
ncsc-2025-0157	Kwetsbaarheden verholpen in Microsoft Defender	2025-05-13T19:14:25.545635Z	2025-05-13T19:14:25.545635Z
ncsc-2025-0156	Kwetsbaarheden verholpen in Microsoft Azure	2025-05-13T19:10:10.012472Z	2025-05-13T19:10:10.012472Z
ncsc-2025-0155	Kwetsbaarheden verholpen in Microsoft Office	2025-05-13T18:58:56.989073Z	2025-05-13T18:58:56.989073Z
ncsc-2025-0154	Kwetsbaarheden verholpen in Microsoft Dynamics Dataverse	2025-05-13T18:44:03.290810Z	2025-05-13T18:44:03.290810Z
ncsc-2025-0153	Kwetsbaarheden verholpen in Microsoft Developer Tools	2025-05-13T18:35:28.760017Z	2025-05-13T18:35:28.760017Z
ncsc-2025-0151	Kwetsbaarheden verholpen in Apple macOS	2025-05-13T09:19:37.094950Z	2025-05-13T09:19:37.094950Z
ncsc-2025-0150	Kwetsbaarheden verholpen in Apple iOS en iPadOS	2025-05-13T09:14:44.606584Z	2025-05-13T09:14:44.606584Z
ncsc-2025-0149	Kwetsbaarheden verholpen in SAP producten	2025-05-13T09:05:38.110295Z	2025-05-13T09:05:38.110295Z
ncsc-2025-0148	Kwetsbaarheden verholpen in ASUS DriverHub	2025-05-12T13:22:18.034442Z	2025-05-12T13:22:18.034442Z
ncsc-2025-0147	Kwetsbaarheden verholpen in F5 BIG-IP	2025-05-09T08:07:32.002935Z	2025-05-09T08:07:32.002935Z
ncsc-2025-0146	Kwetsbaarheden verholpen in Cisco IOS XE Software	2025-05-08T08:43:57.415709Z	2025-05-08T08:43:57.415709Z
ncsc-2025-0145	Kwetsbaarheden verholpen in SonicWall SMA100	2025-05-08T08:40:26.301646Z	2025-05-08T08:40:26.301646Z
ncsc-2025-0144	Kwetsbaarheden verholpen in SysAid On-Prem	2025-05-08T06:56:21.378830Z	2025-05-08T06:56:21.378830Z
ncsc-2025-0143	Kwetsbaarheden verholpen in Google Android en Samsung Mobile	2025-05-07T11:19:50.517092Z	2025-05-07T11:19:50.517092Z
ncsc-2025-0142	Kwetsbaarheden verholpen in Mozilla Firefox en Thunderbird	2025-05-06T08:01:05.582708Z	2025-05-06T08:01:05.582708Z
ncsc-2025-0138	Kwetsbaarheid verholpen in Commvault Command Center	2025-04-24T13:09:08.399556Z	2025-05-06T06:55:31.232567Z
ncsc-2025-0119	Kwetsbaarheden verholpen in SAP-producten	2025-04-09T09:12:05.705017Z	2025-04-30T13:12:27.070565Z

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
ssa-542540	SSA-542540: Out of Bounds Read Vulnerability in Teamcenter Visualization	2025-05-13T00:00:00Z	2025-05-13T00:00:00Z
ssa-523418	SSA-523418: Information Disclosure Vulnerability in Desigo CC	2025-05-13T00:00:00Z	2025-05-13T00:00:00Z
ssa-455250	SSA-455250: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices Before V11.1.2-h3	2024-04-09T00:00:00Z	2025-05-13T00:00:00Z
ssa-446307	SSA-446307: Authentication Bypass Vulnerability in BMC (CVE-2024-54085) affects SIMATIC IPC RS-828A	2025-05-13T00:00:00Z	2025-05-13T00:00:00Z
ssa-373591	SSA-373591: Buffer Overflow Vulnerability in RUGGEDCOM ROS Devices	2021-07-13T00:00:00Z	2025-05-13T00:00:00Z
ssa-339086	SSA-339086: Insufficient Session Expiration Vulnerability in SIMATIC PCS neo	2025-05-13T00:00:00Z	2025-05-13T00:00:00Z
ssa-222768	SSA-222768: Multiple Vulnerabilities in SIRIUS 3SK2 Safety Relays and 3RK3 Modular Safety Systems	2025-05-13T00:00:00Z	2025-05-13T00:00:00Z
ssa-162255	SSA-162255: Multiple Vulnerabilities in Polarion Before V2410	2025-05-13T00:00:00Z	2025-05-13T00:00:00Z
ssa-103653	SSA-103653: Denial-of-Service Vulnerability in Automation License Manager	2024-09-10T00:00:00Z	2025-05-13T00:00:00Z
ssa-047424	SSA-047424: Code Execution and SQL Injection Vulnerabilities in OZW Web Servers	2025-05-13T00:00:00Z	2025-05-13T00:00:00Z
ssa-039007	SSA-039007: Heap-based Buffer Overflow Vulnerability in User Management Component (UMC)	2024-09-10T00:00:00Z	2025-05-13T00:00:00Z
ssa-443402	SSA-443402: Multiple SQL Injection Vulnerabilities in TeleControl Server Basic before V3.1.2.2	2025-04-16T00:00:00Z	2025-04-16T00:00:00Z
ssa-395348	SSA-395348: Improper Handling of Length Parameter Inconsistency Vulnerability in TeleControl Server Basic before V3.1.2.2	2025-04-16T00:00:00Z	2025-04-16T00:00:00Z
ssa-913875	SSA-913875: Frame Aggregation and Fragmentation Vulnerabilities in 802.11	2021-07-13T00:00:00Z	2025-04-08T00:00:00Z
ssa-817234	SSA-817234: Multiple Kubernetes Ingress NGINX Controller Vulnerabilities in Insights Hub Private Cloud	2025-04-08T00:00:00Z	2025-04-08T00:00:00Z
ssa-686975	SSA-686975: IPU 2022.3 Vulnerabilities in Siemens Industrial Products using Intel CPUs	2023-02-14T00:00:00Z	2025-04-08T00:00:00Z
ssa-672923	SSA-672923: Out of Bounds Write Vulnerability in Solid Edge	2025-04-08T00:00:00Z	2025-04-08T00:00:00Z
ssa-525431	SSA-525431: Privilege Escalation Vulnerabilities in Siemens License Server Before V4.3	2025-04-08T00:00:00Z	2025-04-08T00:00:00Z
ssa-503939	SSA-503939: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP	2025-03-11T00:00:00Z	2025-04-08T00:00:00Z
ssa-369369	SSA-369369: Weak Registry Permission Vulnerability in SIMATIC IPC DiagBase and SIMATIC IPC DiagMonitor	2025-02-11T00:00:00Z	2025-04-08T00:00:00Z
ssa-306654	SSA-306654: Insyde BIOS Vulnerabilities in Siemens Industrial Products	2022-02-22T00:00:00Z	2025-04-08T00:00:00Z
ssa-277137	SSA-277137: Multiple Vulnerabilities in SIDIS Prime Before V4.0.700	2025-04-08T00:00:00Z	2025-04-08T00:00:00Z
ssa-195895	SSA-195895: User Enumeration Vulnerability in the Webserver of SIMATIC Products	2025-02-11T00:00:00Z	2025-04-08T00:00:00Z
ssa-187636	SSA-187636: Multiple Vulnerabilities in SENTRON 7KT PAC1260 Data Manager	2025-04-08T00:00:00Z	2025-04-08T00:00:00Z
ssa-920092	SSA-920092: Memory Corruption Vulnerability in Simcenter Femap	2025-03-13T00:00:00Z	2025-03-13T00:00:00Z
ssa-787280	SSA-787280: Unlocked Bootloader Vulnerability in SINAMICS S200	2025-03-11T00:00:00Z	2025-03-11T00:00:00Z
ssa-620288	SSA-620288: Multiple Vulnerabilities (NUCLEUS:13) in Capital Embedded AR Classic	2021-12-14T00:00:00Z	2025-03-11T00:00:00Z
ssa-615740	SSA-615740: Multiple Vulnerabilities in SINEMA Remote Connect Client Before V3.2 SP3	2025-03-11T00:00:00Z	2025-03-11T00:00:00Z
ssa-515903	SSA-515903: Multiple Vulnerabilities in SiPass integrated AC5102 / ACC-G2 and ACC-AP	2025-03-11T00:00:00Z	2025-03-11T00:00:00Z
ssa-507653	SSA-507653: Improper Access Control Vulnerabilities in Tecnomatix Plant Simulation	2025-03-11T00:00:00Z	2025-03-11T00:00:00Z

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
rhsa-2025:0650	Red Hat Security Advisory: OpenShift Container Platform 4.16.32 bug fix and security update	2025-01-29T00:56:20+00:00	2025-07-13T22:07:40+00:00
rhsa-2025:0390	Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.4 release	2025-01-16T17:44:29+00:00	2025-07-13T22:07:40+00:00
rhsa-2025:1710	Red Hat Security Advisory: OpenShift Container Platform 4.15.46 security and extras update	2025-02-27T00:58:32+00:00	2025-07-13T22:07:38+00:00
rhsa-2025:1386	Red Hat Security Advisory: OpenShift Container Platform 4.16.35 security update	2025-02-19T19:45:29+00:00	2025-07-13T22:07:38+00:00
rhsa-2025:1119	Red Hat Security Advisory: OpenShift Container Platform 4.17.16 bug fix and security update	2025-02-11T10:53:54+00:00	2025-07-13T22:07:38+00:00
rhsa-2025:0832	Red Hat Security Advisory: OpenShift Container Platform 4.12.72 bug fix and security update	2025-02-06T00:45:40+00:00	2025-07-13T22:07:38+00:00
rhsa-2025:0778	Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.6.5 security updates and bug fixes	2025-01-28T20:56:08+00:00	2025-07-13T22:07:38+00:00
rhsa-2024:6122	Red Hat Security Advisory: OpenShift Container Platform 4.18.1 bug fix and security update	2025-02-25T04:38:13+00:00	2025-07-13T22:07:38+00:00
rhsa-2025:2449	Red Hat Security Advisory: OpenShift Container Platform 4.18.4 security update	2025-03-11T02:08:00+00:00	2025-07-13T22:07:32+00:00
rhsa-2025:0370	Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.4 release	2025-01-16T11:44:17+00:00	2025-07-13T22:07:32+00:00
rhsa-2025:0649	Red Hat Security Advisory: OpenShift Container Platform 4.16.32 security and extras update	2025-01-29T00:29:19+00:00	2025-07-13T22:07:31+00:00
rhsa-2025:1331	Red Hat Security Advisory: Gatekeeper v3.17.1	2025-02-12T17:47:51+00:00	2025-07-13T22:07:30+00:00
rhsa-2025:0831	Red Hat Security Advisory: OpenShift Container Platform 4.12.72 security and extras update	2025-02-06T00:36:22+00:00	2025-07-13T22:07:30+00:00
rhsa-2025:1838	Red Hat Security Advisory: OpenShift Virtualization 4.18.0 Images	2025-02-25T15:12:43+00:00	2025-07-13T22:07:29+00:00
rhsa-2025:1050	Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.4.14	2025-02-05T08:56:35+00:00	2025-07-13T22:07:29+00:00
rhsa-2025:0121	Red Hat Security Advisory: OpenShift Container Platform 4.15.43 bug fix and security update	2025-01-15T02:21:47+00:00	2025-07-13T22:07:29+00:00
rhsa-2025:0783	Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.6 Bug fix update	2025-01-28T20:26:27+00:00	2025-07-13T22:07:28+00:00
rhsa-2025:1866	Red Hat Security Advisory: RHODF-4.14-RHEL-9 security update	2025-02-26T02:32:43+00:00	2025-07-13T22:07:23+00:00
rhsa-2025:1332	Red Hat Security Advisory: Gatekeeper v3.15.3	2025-02-12T17:48:36+00:00	2025-07-13T22:07:22+00:00
rhsa-2025:0576	Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.9.6 bug fixes and container updates	2025-01-22T03:22:29+00:00	2025-07-13T22:07:22+00:00
rhsa-2025:0653	Red Hat Security Advisory: OpenShift Container Platform 4.17.14 security and extras update	2025-01-28T00:55:21+00:00	2025-07-13T22:07:21+00:00
rhsa-2025:1829	Red Hat Security Advisory: RHODF-4.16-RHEL-9 security update	2025-02-25T09:15:15+00:00	2025-07-13T22:07:20+00:00
rhsa-2025:1053	Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.6.5	2025-02-05T09:04:18+00:00	2025-07-13T22:07:20+00:00
rhsa-2025:0875	Red Hat Security Advisory: OpenShift Container Platform 4.17.15 security and extras update	2025-02-05T10:48:52+00:00	2025-07-13T22:07:20+00:00
rhsa-2025:0364	Red Hat Security Advisory: OpenShift Container Platform 4.14.45 bug fix and security update	2025-01-22T03:22:29+00:00	2025-07-13T22:07:20+00:00
rhsa-2025:0140	Red Hat Security Advisory: OpenShift Container Platform 4.16.30 bug fix and security update	2025-01-15T00:51:07+00:00	2025-07-13T22:07:20+00:00
rhsa-2025:1865	Red Hat Security Advisory: RHODF-4.15-RHEL-9 security update	2025-02-26T00:59:33+00:00	2025-07-13T22:07:15+00:00
rhsa-2025:1333	Red Hat Security Advisory: Gatekeeper v3.14.3	2025-02-12T17:36:57+00:00	2025-07-13T22:07:13+00:00
rhsa-2025:0577	Red Hat Security Advisory: Red Hat multicluster global hub 1.3.2 enhancements and container updates	2025-01-22T01:32:21+00:00	2025-07-13T22:07:13+00:00
rhsa-2025:0384	Red Hat Security Advisory: RHSA: Submariner 0.18.4 - bug and security fixes	2025-01-16T18:46:52+00:00	2025-07-13T22:07:12+00:00

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
icsa-19-029-02	Mitsubishi Electric MELSEC-Q Series PLCs	2019-01-29T07:00:00.000000Z	2025-06-24T06:00:00.000000Z
icsa-25-182-04	FESTO Hardware Controller, Hardware Servo Press Kit	2022-07-06T07:00:00.000000Z	2025-06-23T08:00:00.000000Z
icsa-16-145-01a	Moxa MiiNePort Vulnerabilities	2016-02-25T07:00:00.000000Z	2025-06-20T18:15:20.614865Z
va-25-171-01	ClamAV	2025-06-20T00:00:00Z	2025-06-20T00:00:00Z
icsa-12-265-01	Emerson DeltaV Buffer Overflow	2012-06-25T06:00:00.000000Z	2025-06-19T22:40:48.319564Z
icsa-12-258-01	IOServer OPC Server Multiple Vulnerabilities	2012-06-18T06:00:00.000000Z	2025-06-19T22:40:41.973320Z
icsa-15-034-01	Siemens SCALANCE X-200IRT Switch Family User Impersonation Vulnerability	2015-11-06T07:00:00.000000Z	2025-06-18T19:25:20.526318Z
icsa-13-022-02	GE Intelligent Platforms Proficy Cimplicity Multiple Vulnerabilities	2013-10-26T06:00:00.000000Z	2025-06-18T19:25:08.106052Z
icsa-12-354-01a	Ruggedcom ROS Hard-Coded RSA SSL Private Key	2012-09-22T06:00:00.000000Z	2025-06-18T19:25:01.798871Z
icsa-12-342-01b	Rockwell Allen-Bradley MicroLogix, SLC 500, and PLC-5 Fault Generation Vulnerability	2012-09-10T06:00:00.000000Z	2025-06-18T19:24:55.231514Z
icsa-12-249-03	InduSoft ISSymbol ActiveX Control Buffer Overflow	2012-06-09T06:00:00.000000Z	2025-06-18T19:04:35.253383Z
icsa-12-228-01a	Tridium Niagara Vulnerabilities	2012-05-19T06:00:00.000000Z	2025-06-18T19:04:29.046428Z
icsa-15-099-01e	Siemens SIMATIC HMI Devices Vulnerabilities (Update E)	2015-01-10T07:00:00.000000Z	2025-06-18T19:04:22.822443Z
icsa-15-146-01	Mitsubishi Electric MELSEC FX-Series Controllers Denial of Service	2015-02-26T07:00:00.000000Z	2025-06-18T19:04:16.618149Z
icsa-15-153-01	Beckwith Electric TCP Initial Sequence Vulnerability	2015-03-05T07:00:00.000000Z	2025-06-18T19:04:10.391763Z
icsa-15-169-02	Schneider Electric Wonderware System Platform Vulnerabilities	2015-03-21T06:00:00.000000Z	2025-06-18T19:04:04.192744Z
icsa-15-169-01b	Wind River VXWorks TCP Predictability Vulnerability in ICS Devices (Update B)	2015-03-21T06:00:00.000000Z	2025-06-18T19:03:57.981923Z
icsa-12-032-03	GE Intelligent Platforms Proficy Real-Time Information Portal Directory Traversal	2012-11-04T06:00:00.000000Z	2025-06-18T19:03:51.787688Z
icsa-12-079-01	Microsoft Remote Desktop Protocol Memory Corruption Vulnerability	2012-12-21T07:00:00.000000Z	2025-06-18T19:03:45.218685Z
icsa-10-348-01a	Wonderware InBatch Vulnerability	2010-09-16T06:00:00.000000Z	2025-06-17T16:50:19.269504Z
icsa-10-322-02a	Automated Solutions OPC Vulnerability	2010-08-21T06:00:00.000000Z	2025-06-17T16:50:13.013737Z
icsa-16-343-01	Moxa MiiNePort Session Hijack Vulnerabilities	2016-09-11T06:00:00.000000Z	2025-06-17T16:50:00.161907Z
icsa-12-047-01a	Advantech WebAccess Vulnerabilities	2012-11-19T07:00:00.000000Z	2025-06-17T15:46:30.792399Z
icsa-12-150-01	Honeywell HMIWeb Browser Buffer Overflow Vulnerability	2012-03-02T07:00:00.000000Z	2025-06-17T15:46:24.572627Z
icsa-12-146-01a	RuggedCom Weak Cryptography for Password Vulnerability	2012-02-26T07:00:00.000000Z	2025-06-17T15:46:18.307459Z
icsa-12-138-01	Emerson DeltaV Multiple Vulnerabilities	2012-02-18T07:00:00.000000Z	2025-06-17T15:45:47.164093Z
icsa-12-062-01	Wonderware Information Server Multiple Vulnerabilities	2012-12-04T07:00:00.000000Z	2025-06-17T15:45:28.468819Z
icsa-12-059-01	ABB Robot Communications Runtime Buffer Overflow	2012-12-01T07:00:00.000000Z	2025-06-17T15:45:21.808130Z
icsa-25-168-05	Dover Fueling Solutions ProGauge MagLink LX consoles	2025-06-17T06:00:00.000000Z	2025-06-17T06:00:00.000000Z
icsa-25-168-04	Fuji Electric Smart Editor	2025-06-17T06:00:00.000000Z	2025-06-17T06:00:00.000000Z

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
cisco-sa-sna-prvesc-4bqmk33z	Cisco Secure Network Analytics Privilege Escalation Vulnerability	2025-04-16T16:00:00+00:00	2025-04-16T16:00:00+00:00
cisco-sa-nd-unenum-2xffh472	Cisco Nexus Dashboard LDAP Username Enumeration Vulnerability	2025-04-16T16:00:00+00:00	2025-04-16T16:00:00+00:00
cisco-sa-nxos-image-sig-bypas-pqdrqvjl	Cisco NX-OS Software Image Verification Bypass Vulnerability	2024-12-04T16:00:00+00:00	2025-04-07T16:43:32+00:00
cisco-sa-cslu-7ghmzwmw	Cisco Smart Licensing Utility Vulnerabilities	2024-09-04T16:00:00+00:00	2025-04-04T17:44:00+00:00
cisco-sa-meraki-mx-vpn-dos-vnrpdvfb	Cisco Meraki MX and Z Series AnyConnect VPN Denial of Service Vulnerability	2025-04-02T16:00:00+00:00	2025-04-02T16:00:00+00:00
cisco-sa-epnmpi-sxss-gsscpgy4	Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerabilities	2025-04-02T16:00:00+00:00	2025-04-02T16:00:00+00:00
cisco-sa-ece-dos-tc6m9gz8	Cisco Enterprise Chat and Email Denial of Service Vulnerability	2025-04-02T16:00:00+00:00	2025-04-02T16:00:00+00:00
cisco-sa-webex-credexp-xmn85y6	Cisco Webex for BroadWorks Credential Exposure Vulnerability	2025-03-04T16:00:00+00:00	2025-04-01T13:40:00+00:00
cisco-sa-sdwan-xss-zq4kpvyd	Cisco Catalyst SD-WAN Manager Cross-Site Scripting Vulnerability	2024-09-25T16:00:00+00:00	2025-03-28T18:38:53+00:00
cisco-sa-dnac-api-nbpzcjcm	Cisco Catalyst Center Unauthenticated API Access Vulnerability	2025-05-07T16:00:00+00:00	2025-03-26T16:00:00+00:00
cisco-sa-xrike-9wygprgq	Cisco IOS XR Software Internet Key Exchange Version 2 Denial of Service Vulnerability	2025-03-12T16:00:00+00:00	2025-03-12T16:00:00+00:00
cisco-sa-xr792-bwfvdpy	Cisco IOS XR Software Release 7.9.2 Denial of Service Vulnerability	2025-03-12T16:00:00+00:00	2025-03-12T16:00:00+00:00
cisco-sa-sb-lkm-znerzjbz	Cisco IOS XR Software Secure Boot Bypass Vulnerability	2025-03-12T16:00:00+00:00	2025-03-12T16:00:00+00:00
cisco-sa-ncs-hybridacl-crmzffkq	Cisco IOS XR Software Hybrid Access Control List Bypass Vulnerability	2025-03-12T16:00:00+00:00	2025-03-12T16:00:00+00:00
cisco-sa-multicast-ermrsvq7	Cisco IOS XR Software for ASR 9000 Series Routers Layer 3 Multicast Denial of Service Vulnerability	2025-03-12T16:00:00+00:00	2025-03-12T16:00:00+00:00
cisco-sa-modular-acl-u5mepxmm	Cisco IOS XR Software Access Control List Bypass Vulnerability	2025-03-12T16:00:00+00:00	2025-03-12T16:00:00+00:00
cisco-sa-ipv4uni-lfm3cfbu	Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability	2025-03-12T16:00:00+00:00	2025-03-12T16:00:00+00:00
cisco-sa-iosxr-priv-esc-gfqjxvof	Cisco IOS XR Software CLI Privilege Escalation Vulnerability	2025-03-12T16:00:00+00:00	2025-03-12T16:00:00+00:00
cisco-sa-iosxr-bgp-dos-o7stephx	Cisco IOS XR Software Border Gateway Protocol Confederation Denial of Service Vulnerability	2025-03-12T16:00:00+00:00	2025-03-12T16:00:00+00:00
cisco-sa-ios-xr-verii-bypass-hhpwqrvx	Cisco IOS XR Software Image Verification Bypass Vulnerability	2025-03-12T16:00:00+00:00	2025-03-12T16:00:00+00:00
cisco-sa-snmp-dos-sdxnsucw	Cisco IOS, IOS XE, and IOS XR Software SNMP Denial of Service Vulnerabilities	2025-02-05T16:00:00+00:00	2025-03-12T15:22:33+00:00
cisco-sa-sbr042-multi-vuln-ej76pke5	Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers Vulnerabilities	2023-01-11T16:00:00+00:00	2025-03-07T17:33:55+00:00
cisco-sa-tms-xss-vuln-wbtcywxg	Cisco TelePresence Management Suite Cross-Site Scripting Vulnerability	2025-03-05T16:00:00+00:00	2025-03-05T16:44:57+00:00
cisco-sa-secure-dll-injection-aoyzeqsg	Cisco Secure Client for Windows with Secure Firewall Posture Engine DLL Hijacking Vulnerability	2025-03-05T16:00:00+00:00	2025-03-05T16:00:00+00:00
cisco-sa-nxos-ici-dpojbwxk	Cisco Nexus 3000 and 9000 Series Switches Command Injection Vulnerability	2025-02-26T16:00:00+00:00	2025-02-26T16:00:00+00:00
cisco-sa-n3kn9k-healthdos-eoqswk4g	Cisco Nexus 3000 and 9000 Series Switches Health Monitoring Diagnostics Denial of Service Vulnerability	2025-02-26T16:00:00+00:00	2025-02-26T16:00:00+00:00
cisco-sa-apic-multi-vulns-9ummtg5	Cisco Application Policy Infrastructure Controller Vulnerabilities	2025-02-26T16:00:00+00:00	2025-02-26T16:00:00+00:00
cisco-sa-phone-info-disc-yyxswstk	Cisco Video Phone 8875 and Desk Phone 9800 Series Information Disclosure Vulnerability	2025-02-19T16:00:00+00:00	2025-02-19T16:00:00+00:00
cisco-sa-esa-mailpol-bypass-5nvcjzmw	Cisco Secure Email Gateway Email Filter Bypass Vulnerability	2025-02-19T16:00:00+00:00	2025-02-19T16:00:00+00:00
cisco-sa-broadworks-xss-gdpgj58p	Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability	2025-02-19T16:00:00+00:00	2025-02-19T16:00:00+00:00

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
sca-2019-0001	MSC800 affected by hard-coded credentials vulnerability	2019-06-21T10:00:00.000Z	2019-06-21T10:00:00.000Z

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
NN-2022:2-02	Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0	2022-02-14T11:00:00.000Z	2023-11-16T11:00:00.000Z
NN-2022:2-01	Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0	2022-02-14T11:00:00.000Z	2023-11-16T11:00:00.000Z
NN-2021:2-01	Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4	2021-02-22T11:00:00.000Z	2023-11-16T11:00:00.000Z
NN-2021:1-01	Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4	2021-02-22T11:00:00.000Z	2023-11-16T11:00:00.000Z
NN-2020:3-01	Angular template injection on custom report name field	2020-05-26T11:00:00.000Z	2023-11-16T11:00:00.000Z
NN-2020:2-01	Cross-site request forgery attack on change password form	2020-05-26T11:00:00.000Z	2023-11-16T11:00:00.000Z
NN-2019:2-01	CSV Injection on node label	2019-11-11T11:00:00.000Z	2023-11-16T11:00:00.000Z
NN-2019:1-01	Stored XSS in field name data model	2019-11-11T11:00:00.000Z	2023-11-16T11:00:00.000Z

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
msrc_cve-2025-49678	NTFS Elevation of Privilege Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49677	Microsoft Brokering File System Elevation of Privilege Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49676	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49675	Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49674	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49673	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49672	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49671	Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49670	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49669	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49668	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49667	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49666	Windows Server Setup and Boot Event Collection Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49665	Workspace Broker Elevation of Privilege Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49664	Windows User-Mode Driver Framework Host Information Disclosure Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49663	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49661	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49660	Windows Event Tracing Elevation of Privilege Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49659	Windows Transport Driver Interface (TDI) Translation Driver Elevation of Privilege Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49658	Windows Transport Driver Interface (TDI) Translation Driver Information Disclosure Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-49657	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-48824	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-48823	Windows Cryptographic Services Information Disclosure Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-48822	Windows Hyper-V Discrete Device Assignment (DDA) Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-48821	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-48820	Windows AppX Deployment Service Elevation of Privilege Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-48819	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-48818	BitLocker Security Feature Bypass Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-48817	Remote Desktop Client Remote Code Execution Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z
msrc_cve-2025-48816	HID Class Driver Elevation of Privilege Vulnerability	2025-07-08T07:00:00.000Z	2025-07-08T07:00:00.000Z

Vulnerabilities are sorted by update time (recent to old).
ID	Description
var-201402-0026	Buffer overflow in the process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative value in a label_len value. radvd is prone to the follow security vulnerabilities: 1. Multiple local privilege-escalation vulnerability. 2. A local arbitrary file-overwrite vulnerability. 3. Multiple remote denial-of-service vulnerabilities. An attacker can exploit these issues to execute arbitrary code with administrative privileges, overwrite arbitrary files, and cause denial-of-service conditions. The software can replace IPv6 routing for stateless address auto-configuration. A buffer overflow vulnerability exists in the 'process_ra' function in radvd 1.8.1 and earlier. ========================================================================== Ubuntu Security Notice USN-1257-1 November 10, 2011 radvd vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS Summary: radvd could be made to crash or overwrite certain files if it received specially crafted network traffic. Software Description: - radvd: Router Advertisement Daemon Details: Vasiliy Kulikov discovered that radvd incorrectly parsed the ND_OPT_DNSSL_INFORMATION option. The default compiler options for affected releases should reduce the vulnerability to a denial of service. This issue only affected Ubuntu 11.04 and 11.10. (CVE-2011-3601) Vasiliy Kulikov discovered that radvd incorrectly filtered interface names when creating certain files. (CVE-2011-3602) Vasiliy Kulikov discovered that radvd incorrectly handled certain lengths. (CVE-2011-3604) Vasiliy Kulikov discovered that radvd incorrectly handled delays when used in unicast mode, which is not the default in Ubuntu. If used in unicast mode, a remote attacker could cause radvd outages, resulting in a denial of service. (CVE-2011-3605) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.10: radvd 1:1.8-1ubuntu0.1 Ubuntu 11.04: radvd 1:1.7-1ubuntu0.1 Ubuntu 10.10: radvd 1:1.6-1ubuntu0.1 Ubuntu 10.04 LTS: radvd 1:1.3-1.1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-1257-1 CVE-2011-3601, CVE-2011-3602, CVE-2011-3604, CVE-2011-3605 Package Information: https://launchpad.net/ubuntu/+source/radvd/1:1.8-1ubuntu0.1 https://launchpad.net/ubuntu/+source/radvd/1:1.7-1ubuntu0.1 https://launchpad.net/ubuntu/+source/radvd/1:1.6-1ubuntu0.1 https://launchpad.net/ubuntu/+source/radvd/1:1.3-1.1ubuntu0.1 . ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: Gentoo update for radvd SECUNIA ADVISORY ID: SA46930 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/46930/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=46930 RELEASE DATE: 2011-11-21 DISCUSS ADVISORY: http://secunia.com/advisories/46930/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/46930/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=46930 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Gentoo has issued an update for radvd. For more information: SA46200 SOLUTION: Update to "net-misc/radvd-1.8.2" or later. ORIGINAL ADVISORY: GLSA 201111-08: http://www.gentoo.org/security/en/glsa/glsa-201111-08.xml OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201111-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: radvd: Multiple vulnerabilities Date: November 20, 2011 Bugs: #385967 ID: 201111-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in radvd which could potentially lead to privilege escalation, data loss, or a Denial of Service. Background ========== radvd is an IPv6 router advertisement daemon for Linux and BSD. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/radvd < 1.8.2 >= 1.8.2 Description =========== Multiple vulnerabilities have been discovered in radvd. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All radvd users should upgrade to the latest stable version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/radvd-1.8.2" References ========== [ 1 ] CVE-2011-3601 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3601 [ 2 ] CVE-2011-3602 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3602 [ 3 ] CVE-2011-3603 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3603 [ 4 ] CVE-2011-3604 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3604 [ 5 ] CVE-2011-3605 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3605 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201111-08.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2011 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
var-201805-1144	In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, several SQL injection vulnerabilities have been identified, which may allow an attacker to disclose sensitive information from the host. plural Advantech WebAccess The product includes SQL An injection vulnerability exists.Information may be obtained. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess Node. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the handling of the GetAlarms function in BWMobileService.dll. When parsing the ProjectName parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose sensitive information under the context of the database. Advantech WebAccess and others are products of Advantech. Advantech WebAccess is a browser-based HMI/SCADA software. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. WebAccess Dashboard is one of the dashboard components; WebAccess Scada Node is one of the monitoring node components. WebAccess/NMS is a suite of web browsers for the Network Management System (NMS). Advantech WebAccess, etc. Advantech WebAccess is a set of HMI/SCADA software based on browser architecture. The following versions are affected: Advantech WebAccess 8.2_20170817 and earlier, 8.3.0 and earlier; WebAccess Dashboard 2.0.15 and earlier; WebAccess Scada Node 8.3.1 and earlier; WebAccess/NMS 2.0.3 and earlier
var-201805-1143	In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, several stack-based buffer overflow vulnerabilities have been identified, which may allow an attacker to execute arbitrary code. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability.The specific flaw exists within bwsound.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs process. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code under the context of Administrator. Advantech WebAccess and others are products of Advantech. Advantech WebAccess is a browser-based HMI/SCADA software. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. WebAccess Dashboard is one of the dashboard components; WebAccess Scada Node is one of the monitoring node components. WebAccess/NMS is a suite of web browsers for the Network Management System (NMS). A stack buffer overflow vulnerability exists in several Advantech products. Advantech WebAccess is prone to the following security vulnerabilities: 1. Multiple SQL-injection vulnerabilities 2. An information-disclosure vulnerability 3. A file-upload vulnerability 4. Multiple directory-traversal vulnerabilities 5. Multiple stack-based buffer-overflow vulnerabilities 6. A heap-based buffer-overflow vulnerability 7. Multiple arbitrary code-execution vulnerabilities 8. A denial-of-service vulnerability 9. A security-bypass vulnerability 10. A privilege-escalation vulnerability An attacker can exploit these issues to execute arbitrary code in the context of the application, or modify data, or exploit latent vulnerabilities in the underlying database, delete arbitrary files, gain elevated privileges, perform certain unauthorized actions, upload arbitrary files to the affected application gain unauthorized access and obtain sensitive information. Failed attacks will cause denial of service conditions. Advantech WebAccess, etc. Advantech WebAccess is a set of HMI/SCADA software based on browser architecture. The following versions are affected: Advantech WebAccess 8.2_20170817 and earlier, 8.3.0 and earlier; WebAccess Dashboard 2.0.15 and earlier; WebAccess Scada Node 8.3.1 and earlier; WebAccess/NMS 2.0.3 and earlier
var-202005-0008	Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. Authentication is not required to exploit this vulnerability.The specific flaw exists within the implementation of IOCTL 0x0000791d in DATACORE.exe. An attacker can leverage this vulnerability to execute code in the context of Administrator. Advantech WebAccess is a browser-based SCADA software package for monitoring, data acquisition, and visualization. It is used to automate complex industrial processes when remote operation is required
var-202407-0704	A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). Affected devices allow a remote authenticated user or an unauthenticated user with physical access to downgrade the firmware of the device. This could allow an attacker to downgrade the device to older versions with known vulnerabilities. SICAM 8 Power automation platform is a universal, all-in-one hardware and software-based solution for all applications in the power supply sector. SICAM A8000 RTUs are modular devices for remote control and automation applications in all energy supply sectors. SICAM EGS is the gateway for local substations in distribution networks
var-200107-0035	slapd in OpenLDAP 1.x before 1.2.12, and 2.x before 2.0.8, allows remote attackers to cause a denial of service (crash) via an invalid Basic Encoding Rules (BER) length field. Multiple versions of OpenLDAP contain vulnerabilities that may allow denial-of-service attacks. These vulnerabilities were revealed using the PROTOS LDAPv3 test suite and are documented in CERT Advisory CA-2001-18. If your site uses this product, the CERT/CC encourages you to follow the advice provided below. Vulnerabilities exist in slapd in OpenLDAP 1.x versions prior to 1.2.12 and 2.x versions prior to 2.0.8
var-200512-0643	Heap-based buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a crafted (1) QuickTime Image File (QTIF), (2) PICT, or (3) JPEG format image with a long data field. Apple's QuickTime is a player for files and streaming media in a variety of different formats. QuickTime is prone to a remote heap-based overflow vulnerability. This issue presents itself when the application processes a specially crafted QTIF (QuickTime Image) file. A successful attack can result in a remote compromise. Apple QuickTime is prone to a buffer-overflow vulnerability because the application fails to do proper bounds checking on user-supplied data before copying it to finite-sized process buffers. Unsuccessful exploit attempts will most likely crash the application. This issue affects QuickTime 6.5.2 and 7.0.3; other versions may also be vulnerable. QuickTime 7.0.4 may also be vulnerable, but this has not been confirmed. This issue may have previously been discussed in BID 16202 (Apple QuickTime Multiple Code Execution Vulnerabilities). Quicktime will copy to the stack byte by byte when processing the data field of the qtif format file, but it does not perform the correct check, so it will cause a stack overflow in memory. The original function pointer value is 0x44332211. Just overflow it to 0x08332211 and make sure it doesn't crash before overflowing 0x44 to 0x08, and the code will execute. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands and denial of service. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-200512-0611	Multiple heap-based buffer overflows in QuickTime.qts in Apple QuickTime Player 7.0.3 and iTunes 6.0.1 (3) and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a .mov file with (1) a Movie Resource atom with a large size value, or (2) an stsd atom with a modified Sample Description Table size value, and possibly other vectors involving media files. NOTE: item 1 was originally identified by CVE-2005-4127 for a pre-patch announcement, and item 2 was originally identified by CVE-2005-4128 for a pre-patch announcement. Apple's QuickTime is a player for files and streaming media in a variety of different formats. A flaw in QuickTime's handling of Targa (TGA) image format files could allow a remote attacker to execute arbitrary code on a vulnerable system. Apple From QuickTime Version that fixes multiple vulnerabilities in 7.0.4 Has been released.Arbitrary code may be executed by a remote third party, DoS You can be attacked. For more information, see the information provided by the vendor. These issues arise when the application handles specially crafted QTIF, TGA, TIFF, and GIF image formats. Successful exploits of these issues may allow remote attackers to trigger a denial-of-service condition or to gain unauthorized access. This issue affects both Mac OS X and Microsoft Windows releases of the software. This issue may be triggered when the application processes a malformed movie (.MOV) file. Successful exploitation will result in execution of arbitrary code in the context of the currently logged in user. This issue affects Apple QuickTime 7.0.3 and iTunes 6.0.1. Earlier versions may also be affected. Multiple buffer overflow vulnerabilities exist in QuickTime.qts. This specific flaw exists within the QuickTime.qts file which many applications access QuickTime's functionality through. By specially crafting atoms within a movie file, a direct heap overwrite is triggered, and reliable code execution is then possible. Technical Details: Technical Description: The code in QuickTime.qts responsible for the size of the Sample Description Table entries from the 'stsd' atom in a QuickTime-format movie on the heap. According to developer.apple.com, the format of the Sample Description Atom is as follows: Field Description ---------------------------------------------------------------- Size 32-bit int Data Format 4 char code Reserved 6 bytes that must be 0 Data Reference Index 16-bit int Hint Track Version 16-bit unsigned int Last compatible hint track version 16-bit unsigned int Max Packet Size 32-bit int Additional Data Table Variable By setting the size of the Sample Description Table to a size of 00 15 - 00 D0 will cause a heap-based overflow. By supplying the "Last compatible hint track version" field with the value of 00 05 - 00 09, an insufficiently-sized heap block will be allocated, resulting in a classic complete heap memory overwrite during the RtlAllocateHeap() function and the attacker can control memory with data taken from the filename of the .MOV file. This vulnerability can be successfully exploited via an embedded media player in an HTML page, email, or HTML link. References QuickTime: QuickTime File Format http://developer.apple.com/documentation/QuickTime/QTFF/index.html Protection: Retina Network Security Scanner has been updated to identify this vulnerability. Vendor Status: Apple has released a patch for this vulnerability. The patch is available via the Updates section of the affected applications. This vulnerability has been assigned the CVE identifier CVE-2005-4092. Credit: Discovery: Karl Lynn Greetings: 0x41414141 Copyright (c) 1998-2006 eEye Digital Security Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-200512-0300	Heap-based buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a GIF image file with a crafted Netscape Navigator Application Extension Block that modifies the heap in the Picture Modifier block. Apple's QuickTime is a player for files and streaming media in a variety of different formats. A flaw in QuickTime's handling of Targa (TGA) image format files could allow a remote attacker to execute arbitrary code on a vulnerable system. Apple From QuickTime Version that fixes multiple vulnerabilities in 7.0.4 Has been released.Arbitrary code may be executed by a remote third party, DoS You can be attacked. For more information, see the information provided by the vendor. QuickTime is prone to a remote heap-based overflow vulnerability. This issue presents itself when the application processes a specially crafted GIF image file. A successful attack can result in a remote compromise. Versions prior to QuickTime 7.0.4 are vulnerable. This flaw has proven to allow for reliable control of data on the heap chunk and can be exploited via a web site by using ActiveX controls. The heap can be overwritten in the Picture Modifier block. The block size calculate code such as: .text:66A339CC mov ax, [esi+0Ch] .text:66A339D0 xor ecx, ecx .text:66A339D2 mov [esp+34h+var_28], ecx .text:66A339D6 mov [esp+34h+var_24], ecx .text:66A339DA mov [esp+34h+var_20], ecx .text:66A339DE mov [esp+34h+var_1C], ecx .text:66A339E2 mov word ptr [esp+34h+var_10], cx .text:66A339E7 mov [esp+34h+arg_4], eax .text:66A339EB movsx eax, ax .text:66A339EE mov word ptr [esp+34h+var_10+2], cx .text:66A339F3 mov cx, [esi+8] .text:66A339F7 movsx edx, cx .text:66A339FA sub eax, edx .text:66A339FC movsx edx, word ptr [esi+6] .text:66A33A00 add eax, 3Eh .text:66A33A03 push edi .text:66A33A04 movsx edi, word ptr [esi+0Ah] .text:66A33A08 sar eax, 3 .text:66A33A0B lea ebx, [esi+6] .text:66A33A0E and eax, 0FFFFFFFCh .text:66A33A11 sub edi, edx .text:66A33A13 movsx edx, ax .text:66A33A16 mov [esi+4], ax .text:66A33A1A imul edi, edx The allocate code is : .text:66A33A68 push edi .text:66A33A69 call sub_668B5B30 But when it real process data to this memory, it use real decode data to write this memory but didn\xa1\xaft check this heap size. This is segment of the write code function(sub_66AE0A70): .text:66AE0B18 movsx edx, word ptr [edi+12h] ; default .text:66AE0B1C imul edx, [edi+0Ch] .text:66AE0B20 mov ecx, [edi+4] .text:66AE0B23 inc word ptr [edi+16h] .text:66AE0B27 mov eax, [esp+arg_0] .text:66AE0B2B add edx, ecx .text:66AE0B2D mov [eax], edx .text:66AE0B2F mov eax, [ebp+10h] .text:66AE0B32 test eax, eax .text:66AE0B34 jz short loc_66AE0B62 .text:66AE0B36 mov ax, [ebp+1Ch] .text:66AE0B3A mov edx, [ebp+0Ch] .text:66AE0B3D movzx cx, ah .text:66AE0B41 mov ch, al .text:66AE0B43 mov [edx], cx .text:66AE0B46 movsx eax, word ptr [edi+12h] .text:66AE0B4A imul eax, [ebp+14h] .text:66AE0B4E add eax, [ebp+10h] .text:66AE0B51 mov cx, [ebp+18h] .text:66AE0B55 mov [ebp+0Ch], eax .text:66AE0B58 mov [ebp+1Ah], cx .text:66AE0B5C mov word ptr [ebp+1Ch], 0 Vendor Status: Apple has released a patch for this vulnerability. An attacker can create a qtif file and send it to the user via email, web page, or qtif file with activex and can directy overflow a function pointer immediately used so it can bypass any stack overflow protection in systems such as xp sp2 and 2003 sp1. Technical Details: When Quicktime processes the data field of a qtif format file, it will copy it to the stack by a byte to a byte , but there is no proper checking, so it will cause a stack overflow in memory. And in this stack, there is a function pointer which will be used immediately when it pre byte copies, so we can use it to bypass any stack overflow protection, such in xp sp2 and 2003 sp1. The origin function point value is 0x44332211. We only need to overflow it to : 0x08332211, ensuring it didn't cause a crash before the 0x44 has been overflowed to 0x08. When it overflows to 0x08332211, we can execute code to 0x08332211, and can first use javascript to get this memory and set my code in it. call [esp+138h+arg_4] <- call a function point in the stack, but this point can be overflowed References QuickTime: QuickTime File Format http://developer.apple.com/documentation/QuickTime/QTFF/index.html Protection: Retina Network Security Scanner has been updated to identify this vulnerability. Vendor Status: Apple has released a patch for this vulnerability. The patch is available via the Updates section of the affected applications. This vulnerability has been assigned the CVE identifier CVE-2005-2340. Credit: Discovery: Fang Xing Greetings: Thanks to all the guys at eEye, and especially Karl Lynn's help. Copyright (c) 1998-2006 eEye Digital Security Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. Description Apple QuickTime 7.0.4 resolves a number of image and media file handling vulnerabilities. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands and denial of service. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-200512-0297	Integer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a TIFF image file with modified image height and width (ImageWidth) tags. Apple's QuickTime is a player for files and streaming media in a variety of different formats. Apple From QuickTime Version that fixes multiple vulnerabilities in 7.0.4 Has been released.Arbitrary code may be executed by a remote third party, DoS You can be attacked. For more information, see the information provided by the vendor. QuickTime is prone to a remote integer-overflow vulnerability. This issue presents itself when the application processes a specially crafted TIFF file. A successful attack can result in a remote compromise. Versions prior to QuickTime 7.0.4 are vulnerable. Fortinet Security Advisory: FSA-2006-03 Apple QuickTime Player ImageWidth Denial of Service Vulnerability Advisory Date : January 12, 2006 Reported Date : November 28, 2005 Vendor : Apple computers Affected Products : Apple QuickTime Player v7.0.3 Severity : Medium Reference : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710 http://docs.info.apple.com/article.html?artnum=303101 http://www.securityfocus.com/bid/16202/info Description : Fortinet Security Research Team (FSRT) has discovered a Denial of Service Vulnerability in the Apple QuickTime Player. This is due to application failure to sanitize the parameter ImageWidth value while parsing TIFF image files. Impact : Denial of Service Solution : Apple Computers has released a security update for this vulnerability, which is available for downloading from Apples's web site under security update. Fortinet Protection: Fortinet is protecting network from this vulnerability with latest IPS update. Acknowledgment : Dejun Meng of Fortinet Security Research team found this vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. Description Apple QuickTime 7.0.4 resolves a number of image and media file handling vulnerabilities. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands and denial of service. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-200512-0294	Buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via crafted TGA image files. Apple's QuickTime is a player for files and streaming media in a variety of different formats. For more information, see the information provided by the vendor. QuickTime is prone to a remote buffer-overflow vulnerability. This issue presents itself when the application processes a specially crafted TGA image file. A successful attack can result in a remote compromise. Versions prior to QuickTime 7.0.4 are vulnerable. Fortinet Security Advisory: FSA-2006-04 Apple QuickTime Player Improper Memory Access Vulnerability Advisory Date : January 12, 2006 Reported Date : November 28, 2005 Vendor : Apple computers Affected Products : Apple QuickTime Player v7.0.3 Severity : High Reference : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707 http://docs.info.apple.com/article.html?artnum=303101 http://www.securityfocus.com/bid/16202/info Description : Fortinet Security Research Team (FSRT) has discovered a Improper Memory Access Vulnerability in the Apple QuickTime Player. Impact : Execute arbitrary code Solution : Apple Computers has released a security update for this vulnerability, which is available for downloading from Apples's web site under security update. Fortinet Protection: Fortinet is protecting network from this vulnerability with latest IPS update. Acknowledgment : Dejun Meng of Fortinet Security Research team found this vulnerability. Disclaimer : Although Fortinet has attempted to provide accurate information in these materials, Fortinet assumes no legal responsibility for the accuracy or completeness of the information. Please note that Fortinet's product information does not constitute or contain any guarantee, warranty or legally binding representation, unless expressly identified as such in a duly signed writing. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. Description Apple QuickTime 7.0.4 resolves a number of image and media file handling vulnerabilities. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands and denial of service. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-201407-0233	Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the webdact.ocx ActiveX Control. The control does not check the length of an attacker-supplied NodeName string before copying it into a fixed length buffer on the stack. This could allow an attacker to execute arbitrary code in the context of the browser process. Advantech WebAccess HMI/SCADA is an HMI/SCADA software. Advantech WebAccess webvact.ocx, dvs.ocx and webdact.ocx ActiveX controls fail to properly handle long-length named ProjectName, SetParameter, NodeName, CCDParameter, SetColor, AlarmImage, GetParameter, GetColor, ServerResponse, SetBaud and IPAddress parameters, and attackers can build malicious A WEB page that entice a user to access, can crash an application or execute arbitrary code. Advantech WebAccess is prone to multiple remote stack-based buffer-overflow vulnerabilities. Failed exploit attempts will likely cause a denial-of-service condition. Advantech WebAccess 7.1 and prior are vulnerable. The software supports dynamic graphic display and real-time data control, and provides functions of remote control and management of automation equipment
var-201601-0038	Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors. Authentication is not required to exploit this vulnerability.The specific flaw exists within the implementation of the 0x27B1 IOCTL in the ViewSrv subsystem. A stack-based buffer overflow vulnerability exists in a call to BwBuildPath. An attacker can use this vulnerability to execute arbitrary code in the context of an administrator of the system. WebAccess HMI/SCADA software provides remote control and management, allowing users to easily view and configure automation equipment in facility management systems, power stations and building automation systems
var-201801-0394	TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the cmxddns.lua file. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices
var-201904-0181	Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability.The specific flaw exists within bwmakdir.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs process. An attacker can leverage this vulnerability to execute code in the context of Administrator. Advantech WebAccess/SCADA is a set of browser-based SCADA software from Advantech. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. A buffer overflow vulnerability exists in Advantech WebAccess/SCADA. This vulnerability stems from the fact that when the network system or product performs operations on the memory, the data boundary is not correctly verified, resulting in execution to other associated memory locations. erroneous read and write operations
var-202108-1160	Description: A permissions issue was addressed with improved validation. This issue is fixed in watchOS 7.6, tvOS 14.7, macOS Big Sur 11.5. A malicious application may be able to bypass certain Privacy preferences. apple's macOS , tvOS , watchOS There is a vulnerability in improper default permissions.Information may be tampered with. REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none
var-202305-0218	D-Link DAP-1360 webproc WEB_DisplayPage Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. When parsing the getpage and errorpage parameters, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18419. D-Link DAP-1360 is a router from D-Link, a Chinese company
var-202305-0217	D-Link DAP-1360 Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of login requests to the web-based user interface. The firmware contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-18455. D-Link DAP-1360 is a router from D-Link, a Chinese company
var-202305-0216	D-Link DAP-1360 Multiple Parameters Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /cgi-bin/webproc endpoint. When parsing the errorpage and nextpage parameters, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18746. D-Link DAP-1360 is a router from D-Link, a Chinese company
var-202305-0177	D-Link DAP-1360 webproc Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18417. D-Link DAP-1360 is a router from D-Link, a Chinese company
var-202305-0176	D-Link DAP-1360 webproc var:sys_Token Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling requests to the /cgi-bin/webproc endpoint. When parsing the var:sys_Token parameter, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18418. D-Link DAP-1360 is a router from D-Link, a Chinese company
var-202305-0166	D-Link DAP-1360 webproc var:menu Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling requests to the /cgi-bin/webproc endpoint. When parsing the var:menu parameter, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18414. D-Link DAP-1360 is a router from D-Link, a Chinese company
var-202305-0154	D-Link DAP-1360 webproc var:page Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. When parsing the var:page parameter, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18422. D-Link DAP-1360 is a router from D-Link, a Chinese company
var-202305-0153	D-Link DAP-1360 webupg UPGCGI_CheckAuth Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of requests to the /cgi-bin/webupg endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18423. D-Link DAP-1360 is a router from D-Link, a Chinese company
var-202305-0071	D-Link DAP-1360 webproc Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18416. D-Link DAP-1360 is a router from D-Link, a Chinese company
var-202305-0070	D-Link DAP-1360 webproc COMM_MakeCustomMsg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18454. D-Link DAP-1360 is a router from D-Link, a Chinese company
var-202308-3323	D-Link DAP-2622 DDP Change ID Password Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20060. D-Link DAP-2622 is a wireless access point device from D-Link, a Chinese company
var-202308-3185	D-Link DAP-2622 DDP Configuration Backup Filename Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20068. D-Link DAP-2622 is a wireless access point device from D-Link, a Chinese company
var-202308-3131	D-Link DAP-2622 DDP Reset Factory Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20059. D-Link DAP-2622 is a wireless access point device from D-Link, a Chinese company
var-202308-3130	D-Link DAP-2622 DDP Configuration Restore Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20069. D-Link DAP-2622 is a wireless access point device from D-Link, a Chinese company

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
jvndb-2025-000020	+F FS010M vulnerable to OS command injection	2025-03-18T15:01+09:00	2025-03-18T15:01+09:00
jvndb-2025-000017	hostapd vulnerable to improper processing of RADIUS packets	2025-03-12T14:19+09:00	2025-03-12T14:19+09:00
jvndb-2025-000016	Multiple vulnerabilities in RemoteView Agent (for Windows)	2025-03-06T14:27+09:00	2025-03-10T15:22+09:00
jvndb-2025-001898	Multiple vulnerabilities in FutureNet AS series (Industrial Routers) and FA series (Protocol Conversion Machine)	2025-03-04T14:56+09:00	2025-03-04T14:56+09:00
jvndb-2025-001605	"RoboForm Password Manager" App for Android vulnerable to authentication bypass using an alternate path or channel	2025-02-20T20:15+09:00	2025-02-20T20:15+09:00
jvndb-2025-000004	Multiple vulnerabilities in I-O DATA router UD-LT2	2025-01-22T13:55+09:00	2025-02-20T15:55+09:00
jvndb-2025-000014	Multiple cross-site scripting vulnerabilities in Movable Type	2025-02-19T16:19+09:00	2025-02-19T16:19+09:00
jvndb-2025-000015	RevoWorks SCVX and RevoWorks Browser vulnerable to incorrect resource transfer between spheres	2025-02-19T14:51+09:00	2025-02-19T14:51+09:00
jvndb-2025-001563	Out-of-bounds write vulnerability in FUJIFILM Business Innovation Corp. MFPs	2025-02-18T16:33+09:00	2025-02-18T16:33+09:00
jvndb-2025-001562	Out-of-bounds read vulnerability in OMRON CX-Programmer	2025-02-18T16:24+09:00	2025-02-18T16:24+09:00
jvndb-2024-000114	Multiple vulnerabilities in baserCMS	2024-10-25T15:07+09:00	2025-02-18T15:35+09:00
jvndb-2025-001548	Out-of-bounds read vulnerability in Cente middleware	2025-02-17T18:22+09:00	2025-02-17T18:22+09:00
jvndb-2025-000012	Multiple vulnerabilities in The LuxCal Web Calendar	2025-02-17T13:43+09:00	2025-02-17T13:43+09:00
jvndb-2025-000013	acmailer CGI and acmailer DB vulnerable to OS command injection	2025-02-14T16:39+09:00	2025-02-14T16:39+09:00
jvndb-2025-000002	Multiple vulnerabilities in NEC Aterm series (NV25-003)	2025-02-14T15:48+09:00	2025-02-14T15:48+09:00
jvndb-2023-002797	Multiple vulnerabilities in ELECOM and LOGITEC network devices	2023-08-15T11:54+09:00	2025-02-13T15:21+09:00
jvndb-2024-001061	ELECOM wireless LAN routers vulnerable to OS command injection	2024-01-24T17:16+09:00	2025-02-13T14:31+09:00
jvndb-2025-000011	Multiple vulnerabilities in FileMegane	2025-02-13T13:39+09:00	2025-02-13T13:39+09:00
jvndb-2025-000010	acmailer vulnerable to cross-site scripting	2025-02-12T15:05+09:00	2025-02-12T15:05+09:00
jvndb-2024-000078	Multiple vulnerabilities in ELECOM wireless LAN routers	2024-07-30T15:34+09:00	2025-02-12T14:34+09:00
jvndb-2025-001017	Multiple vulnerabilities in STEALTHONE D220/D340/D440	2025-02-06T18:27+09:00	2025-02-06T18:27+09:00
jvndb-2025-001018	Improper restriction of XML external entity reference (XXE) vulnerability in OMRON NB-Designer	2025-02-06T18:26+09:00	2025-02-06T18:26+09:00
jvndb-2025-000008	Multiple vulnerabilities in Defense Platform Home Edition	2025-02-05T14:06+09:00	2025-02-05T14:06+09:00
jvndb-2025-000009	WordPress Plugin "Activity Log WinterLock" vulnerable to cross-site request forgery	2025-02-04T13:58+09:00	2025-02-04T13:58+09:00
jvndb-2025-001244	Clickjacking Vulnerability in JP1/ServerConductor/Deployment Manager	2025-01-30T18:19+09:00	2025-01-30T18:19+09:00
jvndb-2025-000007	SXF Common Library vulnerable to improper input data handling	2025-01-29T14:57+09:00	2025-01-29T14:57+09:00
jvndb-2025-000006	WordPress Plugin "Simple Image Sizes" vulnerable to cross-site scripting	2025-01-28T13:44+09:00	2025-01-28T13:44+09:00
jvndb-2025-000005	EXIF Viewer Classic vulnerable to cross-site scripting	2025-01-27T14:25+09:00	2025-01-27T14:25+09:00
jvndb-2025-000003	FortiWeb vulnerable to SQL injection	2025-01-21T15:59+09:00	2025-01-21T15:59+09:00
jvndb-2025-001027	Linux Ratfor vulnerable to stack-based buffer overflow	2025-01-16T13:27+09:00	2025-01-16T13:27+09:00

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
suse-su-2025:02017-1	Security update for s390-tools	2025-06-19T07:14:56Z	2025-06-19T07:14:56Z
suse-su-2025:02016-1	Security update for screen	2025-06-19T07:14:39Z	2025-06-19T07:14:39Z
suse-su-2025:02015-1	Security update for gdm	2025-06-19T07:14:10Z	2025-06-19T07:14:10Z
suse-su-2025:02014-1	Security update for ignition	2025-06-19T07:13:44Z	2025-06-19T07:13:44Z
suse-su-2025:02013-1	Security update for pam	2025-06-18T18:05:26Z	2025-06-18T18:05:26Z
suse-su-2025:02012-1	Security update for xorg-x11-server	2025-06-18T15:36:17Z	2025-06-18T15:36:17Z
suse-su-2025:02010-1	Security update for redis	2025-06-18T15:25:25Z	2025-06-18T15:25:25Z
suse-su-2025:02005-1	Security update for gdm	2025-06-18T11:22:41Z	2025-06-18T11:22:41Z
suse-su-2025:02004-1	Security update for gdm	2025-06-18T11:22:28Z	2025-06-18T11:22:28Z
suse-su-2025:02003-1	Security update for gdm	2025-06-18T11:21:50Z	2025-06-18T11:21:50Z
suse-su-2025:02002-1	Security update for gdm	2025-06-18T11:21:39Z	2025-06-18T11:21:39Z
suse-su-2025:02001-1	Security update for pam	2025-06-18T11:21:27Z	2025-06-18T11:21:27Z
suse-su-2025:02000-1	Security update for the Linux Kernel	2025-06-18T11:08:16Z	2025-06-18T11:08:16Z
suse-su-2025:01999-1	Security update for python-requests	2025-06-18T08:43:00Z	2025-06-18T08:43:00Z
suse-su-2025:01998-1	Security update for python-requests	2025-06-18T08:42:28Z	2025-06-18T08:42:28Z
suse-su-2025:01997-1	Security update for python3-requests	2025-06-18T08:41:18Z	2025-06-18T08:41:18Z
suse-su-2025:01995-1	Security update for the Linux Kernel	2025-06-18T08:34:45Z	2025-06-18T08:34:45Z
suse-su-2025:01994-1	Security update 4.3.15.2 SUSE Manager Server 4.3	2025-06-18T02:13:38Z	2025-06-18T02:13:38Z
suse-su-2025:01992-1	Security update for golang-github-prometheus-alertmanager	2025-06-18T02:12:57Z	2025-06-18T02:12:57Z
suse-su-2025:01991-1	Security update for grafana	2025-06-18T02:12:17Z	2025-06-18T02:12:17Z
suse-su-2025:01990-1	Security update for golang-github-prometheus-prometheus	2025-06-18T02:11:49Z	2025-06-18T02:11:49Z
suse-su-2025:01989-1	Security update for Multi-Linux Manager Client Tools	2025-06-18T02:11:23Z	2025-06-18T02:11:23Z
suse-su-2025:01988-1	Security update for golang-github-prometheus-node_exporter	2025-06-18T02:10:11Z	2025-06-18T02:10:11Z
suse-su-2025:01987-1	Security update for Multi-Linux Manager Client Tools	2025-06-18T02:09:10Z	2025-06-18T02:09:10Z
suse-su-2025:01985-1	Security update 4.3.15 for Multi-Linux Manager Server	2025-06-18T02:07:51Z	2025-06-18T02:07:51Z
suse-su-2025:01983-1	Security update for the Linux Kernel	2025-06-17T15:32:57Z	2025-06-17T15:32:57Z
suse-su-2025:01982-1	Security update for the Linux Kernel	2025-06-17T15:32:16Z	2025-06-17T15:32:16Z
suse-su-2025:01981-1	Security update for xorg-x11-server	2025-06-17T15:30:54Z	2025-06-17T15:30:54Z
suse-su-2025:01980-1	Security update for xorg-x11-server	2025-06-17T15:30:27Z	2025-06-17T15:30:27Z
suse-su-2025:01979-1	Security update for xorg-x11-server	2025-06-17T15:30:13Z	2025-06-17T15:30:13Z

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
opensuse-su-2025:15262-1	podman-5.5.2-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15261-1	perl-YAML-LibYAML-0.904.0-2.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15260-1	perl-File-Find-Rule-0.350.0-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15259-1	perl-CryptX-0.87.0-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15258-1	perl-32bit-5.40.2-3.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15257-1	pam_pkcs11-0.6.13-2.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15256-1	pam-1.7.1-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15255-1	ovmf-202505-2.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15254-1	openbao-2.3.1-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15253-1	opa-1.6.0-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15252-1	oci-cli-3.61.0-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15251-1	nova-3.11.4-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15250-1	corepack22-22.15.1-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15249-1	nodejs-electron-35.6.0-1.2 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15248-1	nix-2.29.1-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15247-1	moarvm-2025.05-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15246-1	mirrorsorcerer-0.1.3~1-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15245-1	ggml-devel-5699-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15244-1	libtpms-devel-0.10.1-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15243-1	libssh-config-0.11.2-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15242-1	libsoup-2_4-1-2.74.3-12.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15241-1	libsoup-3_0-0-3.6.5-6.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15240-1	libQt5Bootstrap-devel-static-32bit-5.15.17+kde122-2.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15239-1	libgcrypt-devel-1.11.1-2.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15238-1	libetebase-devel-0.5.8-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15237-1	libbd_btrfs-devel-3.1.1-2.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15236-1	kubernetes1.32-apiserver-1.32.6-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15235-1	kubernetes1.31-apiserver-1.31.10-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15234-1	kubernetes1.30-apiserver-1.30.14-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z
opensuse-su-2025:15233-1	jq-1.8.1-1.1 on GA media	2025-07-03T00:00:00Z	2025-07-03T00:00:00Z

Vulnerabilities are sorted by update time (recent to old).
ID	Description	Published	Updated
cnvd-2025-12885	Zoom Jenkins Marketplace plugin信息泄露漏洞	2025-02-18	2025-06-19
cnvd-2025-12884	WordPress Elementor Website Builder Pro plugin跨站脚本漏洞	2025-06-17	2025-06-19
cnvd-2025-12883	WordPress CryptoCloud - Crypto Payment Gateway plugin权限提升漏洞	2025-06-17	2025-06-19
cnvd-2025-12882	WordPress CraftXtore plugin文件包含漏洞	2025-06-17	2025-06-19
cnvd-2025-12881	WordPress Blogvy plugin文件包含漏洞	2025-06-17	2025-06-19
cnvd-2025-12880	WordPress Blogty plugin文件包含漏洞	2025-06-17	2025-06-19
cnvd-2025-12879	TOTOLINK AC1200缓冲区溢出漏洞	2024-09-11	2025-06-19
cnvd-2025-12878	TOTOLINK A3000RU访问控制错误漏洞	2025-03-28	2025-06-19
cnvd-2025-12877	TOTOLINK A720R信息泄露漏洞	2025-05-14	2025-06-19
cnvd-2025-12876	TOTOLINK N302R Plus url参数缓冲区溢出漏洞	2025-06-10	2025-06-19
cnvd-2025-12875	TOTOLINK N302R Plus service_type参数缓冲区溢出漏洞	2025-06-10	2025-06-19
cnvd-2025-12874	TOTOLINK T10缓冲区溢出漏洞	2025-06-13	2025-06-19
cnvd-2025-12873	TOTOLINK EX1200T formReflashClientTbl缓冲区溢出漏洞	2025-06-17	2025-06-19
cnvd-2025-12872	TOTOLINK EX1200T /boafrm/formWsc文件缓冲区溢出漏洞	2025-06-17	2025-06-19
cnvd-2025-12871	TOTOLINK EX1200T /boafrm/formIpQoS文件缓冲区溢出漏洞	2025-06-17	2025-06-19
cnvd-2025-12870	TOTOLINK EX1200T /boafrm/formDMZ文件缓冲区溢出漏洞	2025-06-17	2025-06-19
cnvd-2025-12869	WordPress CozyStay plugin反序列化漏洞	2025-06-17	2025-06-19
cnvd-2025-12868	WordPress CLEVER plugin路径遍历漏洞	2025-06-17	2025-06-19
cnvd-2025-12867	WordPress Civi Framework plugin跨站请求伪造漏洞	2025-06-17	2025-06-19
cnvd-2025-12866	WordPress Bunnys Print CSS plugin跨站请求伪造漏洞	2025-06-17	2025-06-19
cnvd-2025-12865	WordPress Broadstreet plugin跨站脚本漏洞	2025-06-17	2025-06-19
cnvd-2025-12864	WordPress Blogprise plugin文件包含漏洞	2025-06-17	2025-06-19
cnvd-2025-12863	WordPress Blogmine plugin文件包含漏洞	2025-06-17	2025-06-19
cnvd-2025-12862	WordPress Blogbyte plugi文件包含漏洞	2025-06-17	2025-06-19
cnvd-2025-12861	WordPress Backup and Staging by WP Time Capsule plugin跨站脚本漏洞	2025-06-17	2025-06-19
cnvd-2025-12860	WordPress Axle Demo Importer plugin文件上传漏洞	2025-06-17	2025-06-19
cnvd-2025-12859	WordPress Avaz plugin文件包含漏洞	2025-06-17	2025-06-18
cnvd-2025-12858	WordPress Arlo plugin路径遍历漏洞	2025-06-17	2025-06-18
cnvd-2025-12857	WordPress Apptha Slider Gallery plugin路径遍历漏洞	2025-06-17	2025-06-18
cnvd-2025-12856	WordPress Abandoned Cart Pro for WooCommerce plugin文件上传漏洞	2025-06-17	2025-06-18