Archive
28 July 2025
Vulnerabilities first published on this day (UTC), newest first.
124 results · Feed
-
High 8.8CVE-2025-54769 Public exploit
KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal
An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution …
-
Medium 5.3
KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information.
-
Medium 6.5
KL-001-2025-014: Xorux LPAR2RRD Read Only User Denial of Service
An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user.
-
Medium 5.3CVE-2025-54765 EPSS 10%
KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the config…
-
Medium 5.3CVE-2025-54766 EPSS 10%
KL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.
-
Medium 6.9
Polkadot Frontier's constructing smart contract can bypass precompile address bounding
Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable…
-
Critical 9.8
RevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)
RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public…
-
Medium 6.9
Polkadot Frontier contains missing `check_inherent` for `note_min_gas_price_target` inflates gas price
Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. The extrinsic note_min_gas_price_target is an inherent extrinsic, meaning only the block producer can call it. To ensure correctness, the ProvideInherent trait should be …
-
Critical 9.9
Polkadot Frontier contains silent failure in Curve25519 arithmetic precompiles with malformed points
Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519Add and Curve25519ScalarMul precompiles incorrectly handle invalid Ristretto point representations. Instead of returnin…
-
Medium 5.4
copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata
copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u …
-
Critical 10.0
Node-SAML Contains SAML Signature Verification Vulnerability
A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attack…
-
High 7.5
Tarfile infinite loop during parsing with negative member offset
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsi…
-
Low 3.7
Netavark: podman: netavark may resolve hostnames to unexpected hosts
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container w…
-
Medium 5.9
HP Linux Imaging and Printing Software - Use of DSA Key
A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the use of a weak code signing key, Digital Signature Algorithm (DSA).
-
Critical 9.4
Extension - nobossextensions.com - Stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla
A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered.
-
Critical 9.4
Extension - firecoders.com - Stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla
A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered.
-
Medium 5.4
DLL hijacking of all PE32 executables on Windows 11 for ARM CPUs
DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt to load B…
-
Medium 5.5
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command
-
Medium 5.5
In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots
-
Medium 5.4
In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint
-
Medium 5.8
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms
-
Medium 4.3
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration
-
Medium 4.8
In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page
-
Medium 4.3
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependen…
-
High 7.5
In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions
-
High 7.7
In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows
-
Low 3.7
In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration
-
Medium 5.4
In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow
-
Medium 6.1
In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in wi…
-
High 7.1
Privilege Management for Windows - Elevation of Privilege
Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any proces…
-
High 7.2
Privilege Management for Windows - Elevation of Privilege
Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile fil…
-
Medium 5.4
IBM Informix Dynamic Server HTML injection
IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
-
High 7.5
IBM Informix Dynamic Server information disclosure
IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
-
Critical 9.8
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image processing (`imagick` as the image library) and either allow file uploads with …
-
Critical 9.3
iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the…
-
Critical 9.4
OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privile…
-
High 8.7
Missing Authentication for Critical Function in GitLab Language Server
Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution
-
Critical 9.3
An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDre…
-
Critical 9.3
A privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840.…
-
Medium 6.1
A reflected cross-site scripting (xss) vulnerability exists in the radiationDoseReport.php functionality of meddream Me…