CVE Vulnerability Catalog

A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.

Roundcube Webmail w wersjach przed 1.5.10 oraz 1.6.x przed 1.6.11 umożliwia zdalne wykonanie kodu przez uwierzytelnionych użytkowników. Problem wynika z braku walidacji parametru _from w URL w pliku program/actions/settings/upload.php, co prowadzi do deserializacji obiektów PHP.

The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.

The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing an attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.

The Meteobridge web interface exposes an endpoint vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges (root) on affected devices.

Występuje dereferencja wskaźnika null w sterowniku funkcji pomocniczej Windows dla WinSock, co pozwala autoryzowanemu atakującemu na lokalne podniesienie uprawnień.

Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiCamera, FortiMail, FortiNDR, FortiRecorder, and FortiVoice allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable to insecure deserialization when a privileged user uploads untrusted or malicious content. This could lead to compromise of confidentiality, integrity, and availability of the host system.

The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (Archive Signal) app users, contrary to the documented end-to-end encryption. This was exploited in the wild in May 2025.

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

SysAid On-Prem versions up to 23.3.40 contain an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.