Archive
September 2025
Vulnerabilities first published in this month (UTC), newest first.
2,069 results · Clear filters · Feed
-
Medium 6.5
In add_attr of sdp_discovery.cc, there is a possible out of bounds read due to a missing bounds check. This could lead …
-
Medium 5.5
In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credent…
-
Medium 5.5
In multiple locations, there is a possible way to persistently DoS the device due to a missing length check. This could…
-
Medium 5.5
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible incorrect verification of proper intent…
-
Medium 5.5
In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. T…
-
Medium 4.4
In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local …
-
Medium 5.1
In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant f…
-
Medium 4.0
In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error …
-
Medium 4.0
In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. Th…
-
Medium 6.2
In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a m…
-
Medium 4.0
In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to…
-
Medium 4.0
In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to loca…
-
Medium 4.4
In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the in…
-
Medium 5.1
In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could l…
-
Medium 5.1CVE-2025-0087 Public exploit
In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing p…
-
Medium 4.0
In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. This coul…
-
Medium 4.0
In MMapVAccess of pmr_os.c, there is a possible out of bounds write due to improper input validation. This could lead t…
-
Medium 4.0
In bta_av_config_ind of bta_av_aact.cc, there is a possible out of bounds read due to type confusion. This could lead t…
-
Medium —
Vaadin Platform possible file bypass via upload validation on the server-side
### Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version.
-
Medium —
Vaadin Flow Components possible file bypass via upload validation on the server-side
### Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the upgrade to a more recent Vaadin version.
-
Medium 6.3
NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause i…
-
Medium 5.5
NVIDIA Cumulus Linux and NVOS products contain a vulnerability, where hashed user passwords are not properly suppressed…
-
Medium 6.5
NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might …
-
Medium 4.2
NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the LS10 could enable an attacker to set an unsa…
-
Medium 4.2
NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the VBIOS could enable an attacker to set an uns…
-
Medium 6.5
IBM Jazz Foundation path traversal
IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated user to upload files to the system due to improper neutralization of sequences that can resolve to a restricted director…
-
Medium 6.1
IBM Jazz Foundation cross-site scripting
IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus al…
-
Medium 4.8
IBM Sterling B2B Integrator cross-site scripting
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed a…
-
Medium 4.7
Tesla Model 3 Physical CAN Bus Injection
Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CAN messages to control remote start functions of the vehicle. Testing completed on Tesla Model 3 vehicles with software …
-
Medium 4.8
Reflected Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in version 4.0.5 of appRain CMF, consisting of an authenticated reflected XSS due to a lack of proper validation of user input, through the 's' parameter in /apprain/developer/debug-log/db.
-
Medium 4.8
Reflected Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in version 4.0.5 of appRain CMF, consisting of an authenticated reflected XSS due to a lack of proper validation of user input, through the 'page' parameter in /apprain/developer/addons.
-
Medium 5.1
Stored Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/…
-
Medium 5.1
Stored Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/…
-
Medium 5.1
Stored Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/…
-
Medium 5.1
Stored Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/…
-
Medium 5.1
Stored Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/…
-
Medium 5.1
Stored Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/…
-
Medium 5.1
Stored Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/…
-
Medium 5.1
Stored Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/…
-
Medium 5.1
Stored Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/…