Latest CVE Feed
-
8.7
HIGHCVE-2013-10050
An OS command injection vulnerability exists in multiple D-Link routers—confirmed on DIR-300 rev A (v1.05) and DIR-615 rev D (v4.13)—via the authenticated tools_vct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the ... Read more
Affected Products :- Published: Aug. 01, 2025
- Modified: Aug. 04, 2025
- Vuln Type: Injection
-
9.3
CRITICALCVE-2013-10049
An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize u... Read more
Affected Products :- Published: Aug. 01, 2025
- Modified: Aug. 06, 2025
- Vuln Type: Injection
-
9.3
CRITICALCVE-2013-10048
An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpoint. By sending speciall... Read more
- Published: Aug. 01, 2025
- Modified: Aug. 04, 2025
- Vuln Type: Injection
-
9.3
CRITICALCVE-2013-10047
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote attackers to upload arbitrary files to the server’s filesystem. By abusing the upload handler and crafting a traversal path, an attacke... Read more
Affected Products :- Published: Aug. 01, 2025
- Modified: Aug. 06, 2025
- Vuln Type: Authentication
-
8.5
HIGHCVE-2013-10046
A local privilege escalation vulnerability exists in Agnitum Outpost Internet Security 8.1 that allows an unprivileged user to execute arbitrary code with SYSTEM privileges. The flaw resides in the acs.exe component, which exposes a named pipe that accept... Read more
Affected Products :- Published: Aug. 01, 2025
- Modified: Aug. 04, 2025
- Vuln Type: Authorization
-
8.7
HIGHCVE-2013-10044
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file u... Read more
Affected Products : openemr- Published: Aug. 01, 2025
- Modified: Aug. 06, 2025
- Vuln Type: Injection
-
8.5
HIGHCVE-2012-10022
Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user ... Read more
Affected Products :- Published: Aug. 01, 2025
- Modified: Aug. 06, 2025
- Vuln Type: Authorization
-
8.0
HIGHCVE-2025-8480
Alpine iLX-507 Command Injection Remote Code Execution. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The ... Read more
- Published: Aug. 01, 2025
- Modified: Aug. 12, 2025
- Vuln Type: Injection
-
7.4
HIGHCVE-2025-8477
Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-507 devices. User interaction is required to exploit this v... Read more
- Published: Aug. 01, 2025
- Modified: Aug. 12, 2025
- Vuln Type: Memory Corruption
-
8.0
HIGHCVE-2025-8476
Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerab... Read more
- Published: Aug. 01, 2025
- Modified: Aug. 12, 2025
- Vuln Type: Misconfiguration
-
7.4
HIGHCVE-2025-8475
Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. User interaction is required to explo... Read more
- Published: Aug. 01, 2025
- Modified: Aug. 12, 2025
- Vuln Type: Memory Corruption
-
6.8
MEDIUMCVE-2025-8474
Alpine iLX-507 CarPlay Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploi... Read more
- Published: Aug. 01, 2025
- Modified: Aug. 12, 2025
- Vuln Type: Memory Corruption
-
6.6
MEDIUMCVE-2025-8473
Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulne... Read more
- Published: Aug. 01, 2025
- Modified: Aug. 12, 2025
- Vuln Type: Injection
-
7.4
HIGHCVE-2025-8472
Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. User interaction is required ... Read more
- Published: Aug. 01, 2025
- Modified: Aug. 12, 2025
- Vuln Type: Memory Corruption
-
6.8
MEDIUMCVE-2025-6037
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In t... Read more
Affected Products : vault- Published: Aug. 01, 2025
- Modified: Aug. 13, 2025
- Vuln Type: Authentication
-
5.7
MEDIUMCVE-2025-6015
Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.... Read more
Affected Products : vault- Published: Aug. 01, 2025
- Modified: Aug. 13, 2025
- Vuln Type: Authentication
-
6.5
MEDIUMCVE-2025-6014
Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.... Read more
Affected Products : vault- Published: Aug. 01, 2025
- Modified: Aug. 13, 2025
- Vuln Type: Authentication
-
3.7
LOWCVE-2025-6011
A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Com... Read more
Affected Products : vault- Published: Aug. 01, 2025
- Modified: Aug. 13, 2025
- Vuln Type: Authentication
-
5.3
MEDIUMCVE-2025-6004
Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.... Read more
Affected Products : vault- Published: Aug. 01, 2025
- Modified: Aug. 13, 2025
- Vuln Type: Authentication
-
9.1
CRITICALCVE-2025-6000
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterpri... Read more
Affected Products : vault- Published: Aug. 01, 2025
- Modified: Aug. 13, 2025
- Vuln Type: Misconfiguration