Archive
April 2025
Vulnerabilities first published in this month (UTC), newest first.
1,606 results · Clear filters · Feed
-
High 8.8
Netgear EX6200 sub_3C8EC buffer overflow
A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. This vulnerability affects the function sub_3C8EC. The manipulation of the argument host leads to buffer overflow. The attack can be initiated remotely. The vendor was conta…
-
High 8.8
Netgear EX6200 sub_3C03C buffer overflow
A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. This affects the function sub_3C03C. The manipulation of the argument host leads to buffer overflow. It is possible to initiate the attack remotely. The vendor was contac…
-
High 8.8
Netgear EX6120 sub_30394 buffer overflow
A vulnerability, which was classified as critical, has been found in Netgear EX6120 1.0.3.94. Affected by this issue is the function sub_30394. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. The vendor was…
-
High 7.1
HCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerability
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.
-
High 8.8
Netgear EX6120 fwAcosCgiInbound buffer overflow
A vulnerability classified as critical was found in Netgear EX6120 1.0.0.68. Affected by this vulnerability is the function fwAcosCgiInbound. The manipulation of the argument host leads to buffer overflow. The attack can be launched remotely. The vendor was c…
-
High 7.5CVE-2025-2082 Public exploit
Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability
Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. Authentication is not required to exploit this vulnerability. The spec…
-
High 7.8
Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability
Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target s…
-
High 7.0
Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability
Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code within the sandbox on the ta…
-
High 7.8
Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability
Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected affected Tesla Model S vehicles. An attacker must first obtain the ability to …
-
High 7.8
Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability
Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the ta…
-
High 8.7
base-x homograph attack allows Unicode lookalike characters to bypass validation.
base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This …
-
High 7.2
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, w…
-
High 7.3
Application is vulnerable to Privilege escalation
: Modification of Assumed-Immutable Data (MAID) vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4; ANC-mini: through 1.1.4.
-
High 8.4
Any user with view access to the XWiki space can change the authenticator
XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16.10.0-rc-1, a user who can access pages located in the XWiki space (by default, anyone) can access th…
-
High 8.2
Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin
Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacker compromise of either the Elastic service or the extender plugin can cause denial of service of the…
-
High 8.5
Azure Virtual Desktop Elevation of Privilege Vulnerability
Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Azure Functions Remote Code Execution Vulnerability
Improper verification of cryptographic signature in Microsoft Azure Functions allows an authorized attacker to execute code over a network.
-
High 8.7
Azure Bot Framework SDK Elevation of Privilege Vulnerability
Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.
-
High 8.1
Microsoft Dynamics Information Disclosure Vulnerability
Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network.
-
High 8.6
Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review requ…
-
High 8.8CVE-2025-27134 Scanner template
Privilege escalation in Joplin server via user patch endpoint
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit t…
-
High 7.5
Joplin Server Vulnerable to Path Traversal
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with `css/pluginAssets` or `js/p…
-
High 8.8
Netgear JWNR2000v2 sub_4238E8 buffer overflow
A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been classified as critical. Affected is the function sub_4238E8. The manipulation of the argument host leads to buffer overflow. It is possible to launch the attack remotely. The vendor was con…
-
High 7.1
Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB …
-
High 7.8
Vulnerability in user management of Automation Builder
Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.
-
High 8.8
Netgear JWNR2000v2 get_cur_lang_ver buffer overflow
A vulnerability, which was classified as critical, has been found in Netgear JWNR2000v2 1.0.0.11. Affected by this issue is the function get_cur_lang_ver. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. The…
-
High 8.8
Netgear JWNR2000v2 default_version_is_new buffer overflow
A vulnerability classified as critical was found in Netgear JWNR2000v2 1.0.0.11. Affected by this vulnerability is the function default_version_is_new. The manipulation of the argument host leads to buffer overflow. The attack can be launched remotely. The ve…
-
High 8.8
Netgear JWNR2000v2 check_language_file buffer overflow
A vulnerability classified as critical has been found in Netgear JWNR2000v2 1.0.0.11. Affected is the function check_language_file. The manipulation of the argument host leads to buffer overflow. It is possible to launch the attack remotely. The vendor was co…
-
High 8.8
A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated …
-
High 7.1
A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authent…
-
High 7.1
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authentica…
-
High 7.5
A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivi…
-
High 7.3
PHPGurukul Student Record System add-course.php sql injection
A vulnerability was found in PHPGurukul Student Record System 3.20. It has been declared as critical. This vulnerability affects unknown code of the file /add-course.php. The manipulation of the argument course-short leads to sql injection. The attack can be …
-
High 7.1
A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticate…
-
High 7.3
PHPGurukul Student Record System add-subject.php sql injection
A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Affected is an unknown function of the file /add-subject.php. The manipulation of the argument sub1 leads to sql injection. It is possible to launch the att…
-
High 7.8
ISPSoft File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsing ISP file.
-
High 7.8
ISPSoft File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsing ISP file.
-
High 7.8
ISPSoft File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Delta Electronics ISPSoft version 3.20 is vulnerable to a Stack-Based buffer overflow vulnerability that could allow an attacker to execute arbitrary code when parsing DVP file.
-
High 7.8
ISPSoft File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsing DVP file.
-
High 7.8
ISPSoft File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Delta Electronics ISPSoft version 3.20 is vulnerable to a Stack-Based buffer overflow vulnerability that could allow an attacker to leverage debugging logic to execute arbitrary code when parsing CBDGL file.