Archive
July 2025
Vulnerabilities first published in this month (UTC), newest first.
189 results · Clear filters · Feed
-
Low 3.7
Kernel: ksmbd brute force delay bypass via asynchronous requests
A vulnerability has been identified in the Linux kernel's ksmbd component (kernel SMB/CIFS server). A security control designed to prevent dictionary attacks, which introduces a 5-second delay during session setup, can be bypassed through the use of asynchron…
-
Low 3.5
HPE Telco Service Activator, Protection Mechanism Failure
Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product
-
Low 3.5
HPE Telco Service Activator, Protection Mechanism Failure
Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product
-
Low 3.5
Campcodes Online Hotel Reservation System add_query_account.php cross site scripting
A vulnerability classified as problematic was found in Campcodes Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admin/add_query_account.php. The manipulation of the argument Name leads to cross site scripting. The at…
-
Low 3.5
Portabilis i-Educar atendidos_cad.php cross site scripting
A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file atendidos_cad.php. The manipulation of the argument nome/nome_social/email leads to cross site s…
-
Low 3.5
D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter.
-
Low 3.5CVE-2025-51385 Public exploit
D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the yyxz_dlink_asp function via the id parameter.
-
Low 3.5
D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter.
-
Low 2.4
code-projects Simple Car Rental System add_vehicles.php cross site scripting
A vulnerability, which was classified as problematic, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing of the file /admin/add_vehicles.php. The manipulation of the argument car_name leads to cross site s…
-
Low 2.5
Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains a Use of Hard-coded Password vulnerability. A low …
-
Low 2.7
GLPI technicians can access unauthorized information through external links
GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.65 through 10.0.18, a technician can use the e…
-
Low 3.5
GLPI has overly permissive URL verification
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 0.84 through 10.0.18, usage of RSS feeds or external calendars when planning is subject to SSRF exploit. T…
-
Low 3.3
Moby's Firewalld reload removes bridge network isolation
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld…
-
Low 3.7
Netavark: podman: netavark may resolve hostnames to unexpected hosts
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container w…
-
Low 3.7
In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration
-
Low 3.1
Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash
A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The at…
-
Low 2.9
sequoia-openpgp vulnerable to out-of-bounds array access leading to panic
The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.
-
Low 2.9
buffered-reader vulnerable to out-of-bounds array access leading to panic
The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.
-
Low 3.3
GNU Binutils DWARF Section dwarf.c process_debug_info memory leak
A vulnerability was found in GNU Binutils 2.44 and classified as problematic. This issue affects the function process_debug_info of the file binutils/dwarf.c of the component DWARF Section Handler. The manipulation leads to memory leak. Attacking locally is a…
-
Low 3.3
GNU Binutils BFD Library elf.c bfd_elf_get_str_section null pointer dereference
A vulnerability has been found in GNU Binutils 2.44 and classified as problematic. This vulnerability affects the function bfd_elf_get_str_section of the file bfd/elf.c of the component BFD Library. The manipulation leads to null pointer dereference. Local ac…
-
Low 3.5
jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java cross site scripting
A vulnerability, which was classified as problematic, has been found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this issue is some unknown functionality of the file GoodsController.java. The manipulation…
-
Low 2.9
Low severity (DoS) vulnerability in sequoia-openpgp
The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.
-
Low 3.7
CosmWasm affected by arithmetic overflows
The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.
-
Low 2.9
curve25519-dalek has timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`
The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM.
-
Low 3.2
Multiple issues involving quote API in shlex
The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.
-
Low 3.1
Unauthenticated Nonce Increment in snow
The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.
-
Low 3.2
serde-json-wasm stack overflow during recursive JSON parsing
The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.
-
Low 3.5
Roothub SystemConfigAdminController.java edit cross site scripting
A vulnerability was found in Roothub up to 2.6. It has been declared as problematic. Affected by this vulnerability is the function Edit of the file src/main/java/cn/roothub/web/admin/SystemConfigAdminController.java. The manipulation leads to cross site scri…
-
Low 3.1
Comodo Dragon IP DNS Leakage Detector cross site scripting
A vulnerability, which was classified as problematic, was found in Comodo Dragon up to 134.0.6998.179. This affects an unknown part of the component IP DNS Leakage Detector. The manipulation leads to cross site scripting. It is possible to initiate the attack…
-
Low 3.7
Comodo Dragon IP DNS Leakage Detector cleartext transmission
A vulnerability, which was classified as problematic, has been found in Comodo Dragon up to 134.0.6998.179. Affected by this issue is some unknown functionality of the component IP DNS Leakage Detector. The manipulation leads to cleartext transmission of sens…
-
Low 3.1
Comodo Dragon HSTS security check
A vulnerability classified as problematic was found in Comodo Dragon up to 134.0.6998.179. Affected by this vulnerability is an unknown functionality of the component HSTS Handler. The manipulation leads to security check for standard. The attack can be launc…
-
Low 3.5CVE-2025-8191 Public exploit
macrozheng mall Swagger UI index.html cross site scripting
A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scri…
-
Low 3.5
code-projects Church Donation System edit_members.php cross site scripting
A vulnerability was found in code-projects Church Donation System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/edit_members.php. The manipulation of the argument fname leads to cross s…
-
Low 3.5CVE-2025-8155 EPSS 25%
D-Link DCS-6010L Management Application vb.htm cross site scripting
A vulnerability has been found in D-Link DCS-6010L 1.15.03 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /vb.htm of the component Management Application. The manipulation of the argument paratest leads t…
-
Low 3.5
KoaJS Koa HTTP Header response.js back redirect
A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It i…
-
Low 2.0
HCL IEM is affected by a cookie attribute not set vulnerability
HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure to potential vulnerabilities.
-
Low 2.6
HCL IEM is affected by a password in cleartext vulnerability
HCL IEM is affected by a password in cleartext vulnerability. Sensitive information is transmitted without adequate protection, potentially exposing it to unauthorized access during transit.
-
Low 2.6
HCL IEM is affected by a concurrent login vulnerability
HCL IEM is affected by a concurrent login vulnerability. The application allows multiple concurrent sessions using the same user credentials, which may introduce security risks.
-
Low 3.7
Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rat…
-
Low 2.9
JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHips…