Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2024-58311 2025-12-12 CRITICAL 9.8 Dormakaba Saflok System 6000 contains a predictable key generation algorithm that allows attackers to derive card access keys from a 32-bit unique identifier. Attackers can exploit the deterministic…
CVE-2024-58305 2025-12-12 HIGH 8.8 WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to…
CVE-2024-58299 2025-12-12 CRITICAL 9.8 PCMan FTP Server 2.0 contains a buffer overflow vulnerability in the 'pwd' command that allows remote attackers to execute arbitrary code. Attackers can send a specially crafted payload…
CVE-2024-14010 2025-12-12 CRITICAL 9.8 Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can inject malicious commands into the 'run…
CVE-2024-58304 2025-12-11 HIGH 7.5 Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL through the unfiltered 'cm' parameter. Attackers can…
CVE-2025-8082 2025-12-12 MEDIUM 6.3 Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS)…
CVE-2025-64011 2025-12-12 MEDIUM 4.3 Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other…
CVE-2025-67779 2025-12-12 HIGH 7.5 It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React…
CVE-2025-14571 2025-12-12 HIGH 7.3 A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Affected by this issue is some unknown functionality of the file /borrow_book.php. Such manipulation of the…
CVE-2025-53960 2025-12-12 MEDIUM 5.9 When encrypting sensitive data, weak encryption keys that are fixed or directly generated based on user passwords are used. Attackers can obtain these keys through methods such as…
CVE-2025-54947 2025-12-12 MEDIUM 5.3 In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for…
CVE-2025-14570 2025-12-12 HIGH 7.3 A flaw has been found in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_admin.php. This manipulation of the…
CVE-2025-14569 2025-12-12 MEDIUM 5.3 A vulnerability was detected in ggml-org whisper.cpp up to 1.8.2. Affected is the function read_audio_data of the file /whisper.cpp/examples/common-whisper.cpp. The manipulation results in use after free. The attack…
CVE-2025-14568 2025-12-12 MEDIUM 6.3 A security vulnerability has been detected in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This impacts an unknown function of the file model/User.php. The manipulation of the argument employee_id/id/admin leads…
CVE-2025-40345 2025-12-12 N/A 0.0 In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound new_pba Discovered by Atuin - Automated Vulnerability Discovery Engine. new_pba comes from the…
CVE-2025-12841 2025-12-12 MEDIUM 5.3 The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options.
CVE-2025-12835 2025-12-12 HIGH 7.3 The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any authenticated users, such as subscriber to delete arbitrary files…
CVE-2025-36925 2025-12-11 HIGH 7.8 In WAVES_send_data_to_dsp of libaoc_waves.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no…
CVE-2025-36927 2025-12-11 HIGH 7.8 In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no…
CVE-2025-36928 2025-12-11 HIGH 7.8 In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no…
CVE-2025-36929 2025-12-11 MEDIUM 5.5 In AreFencesRegistered of gxp_fence_manager.cc, there is a possible information leak due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed.…
CVE-2025-36930 2025-12-11 HIGH 7.8 In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no…
CVE-2025-36931 2025-12-11 HIGH 7.8 In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no…
CVE-2025-36934 2025-12-11 MEDIUM 6.7 In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution…
CVE-2025-64669 2025-12-11 HIGH 7.8 Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally.
CVE-2025-36889 2025-12-11 MEDIUM 5.5 In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed.…
CVE-2025-36912 2025-12-11 MEDIUM 6.5 In cellular modem, there is a possible denial of service due to a logic error in the code. This could lead to remote denial of service with no…
CVE-2025-36916 2025-12-11 HIGH 7.0 In PrepareWorkloadBuffers of gxp_main_actor.cc, there is a possible double fetch due to a race condition. This could lead to local escalation of privilege with no additional execution privileges…
CVE-2025-36917 2025-12-11 MEDIUM 6.5 In SwDcpItg of up_L2commonPdcpSecurity.cpp, there is a possible denial of service due to an incorrect bounds check. This could lead to remote denial of service with no additional…
CVE-2025-36918 2025-12-11 HIGH 7.8 In aoc_service_read_message of aoc_ipc_core.c, there is a possible out of bounds read due to improper input validation. This could lead to local escalation of privilege with System execution…
CVE-2025-36919 2025-12-11 HIGH 7.8 In aocc_read of aoc_channel_dev.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed.…
CVE-2025-36921 2025-12-11 MEDIUM 5.5 In ProtocolPsUnthrottleApn() of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware…
CVE-2025-36922 2025-12-11 MEDIUM 6.7 In bigo_map of bigo_iommu.c, there is a possible information disclosure due to a use after free. This could lead to local escalation of privilege in the OS Kernel…
CVE-2025-36938 2025-12-11 MEDIUM 5.1 In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead to physical escalation of privilege with no…
CVE-2025-65530 2025-12-12 HIGH 8.8 An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary files as root via scanning a crafted file.
CVE-2025-26866 2025-12-12 HIGH 8.8 A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster…
CVE-2025-56129 2025-12-11 HIGH 8.4 OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_diagnosis in file /usr/lib/lua/luci/controller/admin/diagnosis.lua.
CVE-2023-29144 2025-12-12 LOW 3.3 Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. This allows a bypass of detection.
CVE-2025-14567 2025-12-12 MEDIUM 5.3 A weakness has been identified in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This affects an unknown function of the file /api/employees. Executing manipulation can lead to missing authentication. It…
CVE-2025-14566 2025-12-12 HIGH 7.3 A security flaw has been discovered in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The impacted element is an unknown function of the file /Profilers/SProfile/reg.php. Performing manipulation of the argument…
CVE-2025-14565 2025-12-12 HIGH 7.3 A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The affected element is an unknown function of the file /Profilers/SProfile/login1.php. Such manipulation of the argument Username leads…
CVE-2025-13733 2025-12-12 N/A 0.0 BuhoNTFS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects BuhoNTFS: 1.3.2.
CVE-2025-12843 2025-12-12 N/A 0.0 Code Injection using Electron Fuses in waveterm on MacOS allows TCC Bypass. This issue affects waveterm: 0.12.2.
CVE-2025-14536 2025-12-11 HIGH 7.3 A security flaw has been discovered in code-projects Class and Exam Timetable Management 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the…
CVE-2025-14535 2025-12-11 CRITICAL 9.8 A vulnerability was identified in UTT 进取 512W up to 3.1.7.7-171114. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. The manipulation of the argument ssid leads to…
CVE-2025-13481 2025-12-11 HIGH 8.8 IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied…
CVE-2025-13214 2025-12-11 HIGH 7.6 IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify,…
CVE-2025-13211 2025-12-11 MEDIUM 5.3 IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
CVE-2025-13148 2025-12-11 HIGH 8.1 IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.
CVE-2024-42197 2025-12-11 MEDIUM 5.5 HCL Workload Scheduler stores user credentials in plain text which can be read by a local user.
« Anterior Página 216 de 3934 Siguiente »