Archive
20 May 2025
Vulnerabilities first published on this day (UTC), newest first.
23 results · Clear filters · Feed
-
Medium 6.3
Linksys FGW3000-AH/FGW3000-HK HTTP POST Request sysconf.cgi control_panel_sw command injection
A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000. It has been classified as critical. This affects the function control_panel_sw of the file /cgi-bin/sysconf.cgi of the component HTTP POST Request Handler. The manipulation of…
-
Medium 6.3
Linksys FGW3000-AH/FGW3000-HK HTTP POST Request sysconf.cgi sub_4153FC command injection
A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000 and classified as critical. Affected by this issue is the function sub_4153FC of the file /cgi-bin/sysconf.cgi of the component HTTP POST Request Handler. The manipulation of t…
-
Medium 6.5
H3C Magic R200G HTTP POST Request aspForm EditWlanMacList denial of service
A vulnerability has been found in H3C Magic R200G up to 100R002 and classified as problematic. Affected by this vulnerability is the function Edit_BasicSSID/Edit_BasicSSID_5G/SetAPWifiorLedInfoById/SetMobileAPInfoById/Asp_SetTimingtimeWifiAndLed/AddMacList/Ed…
-
Medium 5.3
Hubble CLI vulnerable to character injection
Hubble is a fully distributed networking and security observability platform for cloud native workloads. Prior to version 1.17.2, a network attacker could inject malicious control characters into Hubble CLI terminal output, potentially leading to loss of inte…
-
Medium 6.5
H3C R2+ProG HTTP POST Request aspForm SetAPInfoById denial of service
A vulnerability, which was classified as problematic, was found in H3C R2+ProG up to 200R004. Affected is the function UpdateWanParams/AddMacList/EditMacList/AddWlanMacList/EditWlanMacList/Edit_BasicSSID/Edit_GuestSSIDFor2P4G/Edit_BasicSSID_5G/SetAPInfoById o…
-
Medium 4.3
In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page
-
Medium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible
-
Medium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible
-
Medium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible
-
Medium 4.3
In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning
-
Medium 6.5
IBM Security ReaQta improper certificate validation
IBM Security ReaQta EDR 3.12 could allow an attacker to perform unauthorized actions due to improper SSL certificate validation.
-
Medium 4.3
Improper Control of Interaction Frequency
OpenFlow discovery protocol can exhaust resources because it is not rate limited
-
Medium 6.5
IBM Security ReaQta improper certificate validation
IBM Security ReaQta EDR 3.12 could allow an attacker to spoof a trusted entity by interfering with the communication path between the host and client.
-
Medium 4.3CVE-2025-41228 Public exploit
VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal co…
-
Medium 5.5
Denial-of-Service Vulnerability
VMware ESXi, Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options. A malicious actor with non-administrative privileges within a guest operating system may be able to exploit this issue by exhausting memory of the hos…
-
Medium 6.8
Guest Operations Denial-of-Service Vulnerability
VMware ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. A malicious actor with guest operation privileges on a VM, who is already authenticated through vCenter Server or ESXi may trigger this issue to create a den…
-
Medium 5.4
TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer
TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web s…
-
Medium 5.3
Netgear DGND3700 mini_http currentsetting.htm information disclosure
A vulnerability has been found in Netgear DGND3700 1.1.00.15_1.00.15NA and classified as problematic. This vulnerability affects unknown code of the file /currentsetting.htm of the component mini_http. The manipulation leads to information disclosure. The att…
-
Medium 5.3
Netgear DGND3700 BRS_top.html information disclosure
A vulnerability, which was classified as problematic, has been found in Netgear DGND3700 1.1.00.15_1.00.15NA. Affected by this issue is some unknown functionality of the file /BRS_top.html. The manipulation leads to information disclosure. The attack may be l…
-
Medium 5.1
Stored Cross-Site Scripting (XSS) in Koibox
A Stored Cross-Site Scripting (XSS) vulnerability has been found in Koibox for versions prior to e8cbce2. This vulnerability allows an authenticated attacker to upload an image containing malicious JavaScript code as profile picture in the '/es/dashboard/clie…
-
Medium 4.6
Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in…
-
Medium 6.4
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in various versions due to insufficient input sanitization and output escaping on user supplied attributes.…
-
Medium 6.5
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the interfacenameds parameter in …