Archive
10 February 2025
Vulnerabilities first published on this day (UTC), newest first.
27 results · Clear filters · Feed
-
High 7.3
SourceCodester Employee Management System index.php default credentials
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument username/password leads to use of default c…
-
High 7.5
SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of suc…
-
High 7.3
Pix Software Vivaz servlet sql injection
A vulnerability has been found in Pix Software Vivaz 6.0.10 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login. The manipulation of the argument usuario leads to sql injection. The attack can be initiated remote…
-
High 7.2CVE-2024-13059 EPSS 24%
Path Traversal in mintplex-labs/anything-llm
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote …
-
High 7.5
Local File Inclusion (LFI) in modelscope/agentscope
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulatin…
-
High 8.8
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14…
-
High —
Unknown vulnerability in Coinbase Wallet SDK
### Impact There is a security vulnerability in outdated versions of Coinbase Wallet SDK. This does not directly affect users' keys, smart contracts, or funds. ### Patches Please update to version >= 4.3.0.
-
High 7.8
mm: zswap: properly synchronize freeing resources during CPU hotunplug
In the Linux kernel, the following vulnerability has been resolved: mm: zswap: properly synchronize freeing resources during CPU hotunplug In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the current CPU at the beginning of the operation i…
-
High 7.8CVE-2025-21692 Public exploit
net: sched: fix ets qdisc OOB Indexing
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <g1042620637@gmail.com> found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The ov…
-
High 7.8
vfio/platform: check the bounds of read/write syscalls
In the Linux kernel, the following vulnerability has been resolved: vfio/platform: check the bounds of read/write syscalls count and offset are passed from user space and not checked, only offset is capped to 40 bits, which can be used to read/write out of bo…
-
High 7.3
Camera passwords stored in clear text
A vulnerability exists in the VideONet product included in the listed System 800xA versions, where VideONet is used. An attacker who successfully exploited the vulnerability could, in the worst case scenario, stop or manipulate the video feed. This issue aff…
-
High 8.8
Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker t…
-
High 8.1
Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and…
-
High 8.3
OS Command Injection vulnerability in Revolution Pi
OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to execute OS commands on the device via the ‘php/dal.php’ endpoint, in the ‘arrSaveConfig’ paramete…
-
High 7.0
Information Disclosure Vulnerability in TP-Link Tapo C500 Wi-Fi Camera
This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access could exploit this vulnerability to obtain cryptographic private keys which can then be used to perform…
-
High 8.3
Hardcoded credentials in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to gain root access to the…
-
High 8.8
Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. An attacker can send a specially crafted HTTP PO…
-
High 8.0
Tenda W18E V16.01.0.8(1625) is vulnerable to Buffer Overflow. An attacker with access to the web management portal can …
-
High 8.8
Tenda W18E V16.01.0.8(1625) suffers from authentication bypass in the web management portal allowing an unauthorized re…
-
High 8.8
A default credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access th…
-
High 8.0
A stack overflow vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an authenticated remote …
-
High 8.8
A hardcoded credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access …
-
High 7.3
CouchAuth has a Server-Side Template Injection vulnerability in its email functionality
A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited comman…
-
High 7.2
An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execut…
-
High 7.3
An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitra…
-
High 8.6
Security Update for the OPC UA .NET Standard Stack
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.
-
High 8.0
OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.