Latest CVE Feed
-
6.5
MEDIUMCVE-2025-41234
Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribu... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Misconfiguration
-
6.8
MEDIUMCVE-2025-41233
Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of the issue to be in the Moderate severity range https://www.broadcom.com/support/vmware-services/security-response wi... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Injection
-
6.1
MEDIUMCVE-2025-49589
PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. A stack-based buffer overflow exists in the Kprintf_HLE function of PCSX2 versions up to 2.3.414. Opening a disc image that logs a specially crafted message may allow a remote attacker to execu... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
-
5.4
MEDIUMCVE-2025-44091
yangyouwang crud v1.0.0 is vulnerable to Cross Site Scripting (XSS) via the role management function.... Read more
Affected Products : crud- Published: Jun. 12, 2025
- Modified: Jul. 02, 2025
- Vuln Type: Cross-Site Scripting
-
7.8
HIGHCVE-2025-27689
Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Authorization
-
7.7
HIGHCVE-2025-6031
Amazon Cloud Cam is a home security camera that was deprecated on December 2, 2022, is end of life, and is no longer actively supported. When a user powers on the Amazon Cloud Cam, the device attempts to connect to a remote service infrastructure that h... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Misconfiguration
-
8.8
HIGHCVE-2025-5485
User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from known identifier... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Authentication
-
8.3
HIGHCVE-2025-5484
A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Authentication
-
6.7
MEDIUMCVE-2025-4418
An improper validation of integrity check value vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow a miscreant with elevated privileges to modify PI Connector for CygNet local data files (ca... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Misconfiguration
-
6.9
MEDIUMCVE-2025-4417
A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator miscreant with local access to the connector admin portal to persist arbitrary JavaScript code that... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Cross-Site Scripting
-
7.1
HIGHCVE-2025-44019
AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PI Data Archive subsystems, resulting in a denial of service. Depending on the timing of the cra... Read more
Affected Products : pi_server- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Denial of Service
-
7.1
HIGHCVE-2025-36539
AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PI Data Archive subsystems, resulting in a denial of service.... Read more
Affected Products : pi_server- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Denial of Service
-
6.5
MEDIUMCVE-2025-2745
A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/update annotations or upload media files) to persist arbitrary JavaScript co... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Cross-Site Scripting
-
6.5
MEDIUMCVE-2025-49579
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into t... Read more
Affected Products : citizen- Published: Jun. 12, 2025
- Modified: Aug. 22, 2025
- Vuln Type: Cross-Site Scripting
-
6.5
MEDIUMCVE-2025-49578
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This ... Read more
Affected Products : citizen- Published: Jun. 12, 2025
- Modified: Aug. 22, 2025
- Vuln Type: Cross-Site Scripting
-
6.5
MEDIUMCVE-2025-49577
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in ... Read more
Affected Products : citizen- Published: Jun. 12, 2025
- Modified: Aug. 22, 2025
- Vuln Type: Cross-Site Scripting
-
6.5
MEDIUMCVE-2025-49576
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbi... Read more
Affected Products : citizen- Published: Jun. 12, 2025
- Modified: Aug. 22, 2025
- Vuln Type: Cross-Site Scripting
-
6.5
MEDIUMCVE-2025-49575
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This im... Read more
Affected Products : citizen- Published: Jun. 12, 2025
- Modified: Aug. 22, 2025
- Vuln Type: Misconfiguration
-
6.9
MEDIUMCVE-2025-49081
There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with system administrator permissions can impair the availability of the Secure Access administrative UI ... Read more
Affected Products : secure_access- Published: Jun. 12, 2025
- Modified: Jun. 17, 2025
- Vuln Type: Denial of Service
-
1.7
LOWCVE-2025-43866
vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictabl... Read more
Affected Products : vantage6- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Cryptography