Archive
16 April 2025
Vulnerabilities first published on this day (UTC), newest first.
373 results · Feed
-
High 8.8
Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacke…
-
Medium 6.5
ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled user…
-
High 8.8
Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS [6.1, 5.15, 5.10, 5.4, 4.19] allows a local attacker wit…
-
High 7.5
DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose …
-
Medium 6.8
Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal
Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that direct…
-
Medium 4.9
Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of …
-
Medium 4.9
Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of …
-
Medium 4.4
Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) Description Hitachi Vantara Pentaho Business Analytics Server pr…
-
Medium 6.8
Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal
Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that direct…
-
Critical 9.1
Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')
Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Description Hitach…
-
Medium 4.4
Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) Description Hitachi Vantara Pentaho Business Analytics Server pr…
-
Medium 6.1
Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource
Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732) Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, …
-
Medium 4.3
Permission policy information leakage in Backstage permission system
The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permissio…
-
Low 3.1
EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function
EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the…
-
Low 3.1
SoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRA
SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in `DeleteIPv6DefaultRouterInRA` called by `StorePacket`. Before dereferencing, `DeleteIPv6DefaultRouterInRA` does n…
-
Medium 4.7
XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki
XWiki Platform is a generic wiki platform. A vulnerability in versions from 5.0 to 16.7.1 affects users with Message Stream enabled and a wiki configured as closed from selecting "Prevent unregistered users to view pages" in the Administrations Rights. The vu…
-
Critical 10.0
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protoc…
KEV Jun 9, 2025 -
High 7.8
Omnissa Horizon Client for Windows contains an LPE Vulnerability. A malicious actor with local access where Horizon Cli…
-
High 8.2
Zulip Authentication Backend Configuration Bypass
Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a single-sign on authentication backend, meaning the organization places no restrictions on email addre…
-
Low 3.3
PyTorch LossCTC.cpp torch.nn.functional.ctc_loss denial of service
A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached l…
-
High 7.3
SourceCodester Web-based Pharmacy Product Management System Database Backup backup.php os command injection
A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some unknown processing of the file backup.php of the component Database Backup Handler. The manipulation …
-
High 8.8
Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap cor…
-
High 8.8
Heap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a remote attacker to potentia…
-
Medium 5.3
SourceCodester Simple Hotel Booking System login buffer overflow
A vulnerability classified as critical was found in SourceCodester Simple Hotel Booking System 1.0. This vulnerability affects the function Login. The manipulation of the argument uname leads to buffer overflow. It is possible to launch the attack on the loca…
-
High 7.3
PCMan FTP Server STATUS Command buffer overflow
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component STATUS Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has b…
-
High 7.3
PCMan FTP Server CD Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component CD Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The e…
-
High 7.3
PCMan FTP Server MIC Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component MIC Command Handler. The manipulation leads to buffer overflow. The attack can be launched remot…
-
High 7.3
PCMan FTP Server DIR Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component DIR Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit…
-
High 7.3
PCMan FTP Server MDTM Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. This issue affects some unknown processing of the component MDTM Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has …
-
Medium 6.1
A Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) client, this …
-
Critical 9.8
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Se…
KEV Apr 17, 2025 -
Critical 9.8
A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.…
KEV Apr 17, 2025 -
High 8.1
PgBouncer default auth_query does not take Postgres password expiry into account
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …