Latest CVE Feed
-
1.7
LOWCVE-2025-43863
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password ... Read more
Affected Products : vantage6- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Authentication
-
7.5
HIGHCVE-2025-5982
An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.... Read more
Affected Products : gitlab- Published: Jun. 12, 2025
- Modified: Aug. 12, 2025
- Vuln Type: Authorization
-
8.7
HIGHCVE-2025-49080
There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack compl... Read more
Affected Products : secure_access- Published: Jun. 12, 2025
- Modified: Jun. 23, 2025
- Vuln Type: Denial of Service
-
7.5
HIGHCVE-2024-55567
Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before 05.71.01. The SMM module has an SMM call out vulnerability which can be used to write arbitrary... Read more
Affected Products : insydeh2o- Published: Jun. 12, 2025
- Modified: Aug. 20, 2025
- Vuln Type: Memory Corruption
-
5.4
MEDIUMCVE-2023-45256
Multiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to execute arbitrary SQL commands via the TPE, societe, MAC, reference, or aliascb parameter to transaction.php, valid... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 17, 2025
- Vuln Type: Injection
-
9.3
CRITICALCVE-2025-49467
A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges.... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-46035
Buffer Overflow vulnerability in Tenda AC6 v.15.03.05.16 allows a remote attacker to cause a denial of service via the oversized schedStartTime and schedEndTime parameters in an unauthenticated HTTP GET request to the /goform/openSchedWifi endpoint... Read more
- Published: Jun. 12, 2025
- Modified: Jun. 17, 2025
-
7.1
HIGHCVE-2025-36573
Dell Smart Dock Firmware, versions prior to 01.00.08.01, contain an Insertion of Sensitive Information into Log File vulnerability. A user with local access could potentially exploit this vulnerability, leading to Information disclosure.... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Information Disclosure
-
5.4
MEDIUMCVE-2025-29744
pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.... Read more
Affected Products : pg-promise- Published: Jun. 12, 2025
- Modified: Jul. 02, 2025
- Vuln Type: Injection
-
7.3
HIGHCVE-2024-7562
A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. All supported versions (InstallShield 2023 R2, InstallShield 2022 R2 and InstallShield 2021 R2) ... Read more
Affected Products : installshield- Published: Jun. 12, 2025
- Modified: Jun. 16, 2025
- Vuln Type: Authentication
-
6.5
MEDIUMCVE-2024-44906
uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15.... Read more
Affected Products : pgdriver- Published: Jun. 12, 2025
- Modified: Aug. 13, 2025
- Vuln Type: Injection
-
6.5
MEDIUMCVE-2024-44905
go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.... Read more
Affected Products : pg- Published: Jun. 12, 2025
- Modified: Jul. 09, 2025
- Vuln Type: Injection
-
6.5
MEDIUMCVE-2025-49200
The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup files.... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Information Disclosure
-
8.8
HIGHCVE-2025-49199
The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows the attacker to disrupt the application by configuring the services in a way that they a... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Misconfiguration
-
3.1
LOWCVE-2025-49198
The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible tokens.... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 12, 2025
-
6.5
MEDIUMCVE-2025-49197
The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account.... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Authentication
-
6.5
MEDIUMCVE-2025-49196
A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in unexpected ways or spoof identities of other users or devices, affecting the confidentiality and integrity of the de... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Misconfiguration
-
5.3
MEDIUMCVE-2025-49195
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Authentication
-
7.5
HIGHCVE-2025-49194
The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic between a client and this server, the credentials would be exposed.... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Authentication
-
4.2
MEDIUMCVE-2025-49193
The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected ma... Read more
Affected Products :- Published: Jun. 12, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Misconfiguration