Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2025-9478 2025-08-26 HIGH 8.8 Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity:…
CVE-2025-56694 2025-08-27 MEDIUM 5.8 Client-side password validation (CWE-602) in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums.
CVE-2025-53105 2025-08-27 HIGH 7.5 GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software…
CVE-2025-52122 2025-08-27 CRITICAL 9.8 Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to…
CVE-2025-50989 2025-08-27 HIGH 8.8 OPNsense 25.1 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a system-level command without proper sanitization…
CVE-2025-50986 2025-08-27 MEDIUM 5.6 diskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its administrative settings interface. Various configuration fields such as ES_HOST, ES_INDEXREFRESH, ES_PORT, ES_SCROLLSIZE, ES_TRANSLOGSIZE, ES_TRANSLOGSYNCINT,…
CVE-2025-50975 2025-08-26 MEDIUM 5.4 IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark, src_addr, std_net_tgt, and tgt_addr, allowing an authenticated administrator…
CVE-2025-26417 2025-08-26 MEDIUM 4.0 In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. This could lead to local…
CVE-2025-22413 2025-08-26 MEDIUM 4.0 In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local information disclosure with no…
CVE-2025-22412 2025-08-26 HIGH 8.8 In multiple functions of sdp_server.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution…
CVE-2025-0084 2025-08-26 HIGH 8.8 In multiple locations, there is a possible out of bounds write due to a use after free. This could lead to remote code execution over Bluetooth, if HFP…
CVE-2025-0082 2025-08-26 MEDIUM 5.5 In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information…
CVE-2025-0081 2025-08-26 HIGH 7.5 In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data. This could lead to remote denial of service with no additional…
CVE-2025-0075 2025-08-26 CRITICAL 9.8 In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no…
CVE-2025-0074 2025-08-26 CRITICAL 9.8 In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no…
CVE-2023-21125 2025-08-26 HIGH 8.0 In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege over Bluetooth…
CVE-2025-9529 2025-08-27 HIGH 7.3 A weakness has been identified in Campcodes Payroll Management System 1.0. The affected element is the function include of the file /index.php. This manipulation of the argument page…
CVE-2025-9528 2025-08-27 MEDIUM 4.7 A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function systemCommand of the file /goform/systemCommand. Executing manipulation of the argument command can lead to os…
CVE-2025-9527 2025-08-27 HIGH 8.8 A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function QoSSetup of the file /goform/QoSSetup. Performing manipulation of the argument ack_policy results in stack-based buffer overflow.…
CVE-2025-9510 2025-08-27 HIGH 7.3 A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. The affected element is an unknown function of the file /branch/addbranch.php. The manipulation of the argument…
CVE-2025-9509 2025-08-27 HIGH 7.3 A security flaw has been discovered in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /report/fair_info_all.php. Performing manipulation of the argument fid…
CVE-2025-9508 2025-08-27 HIGH 7.3 A vulnerability was detected in itsourcecode Apartment Management System 1.0. The impacted element is an unknown function of the file /report/rented_info.php. The manipulation of the argument rsid results…
CVE-2025-9503 2025-08-27 HIGH 7.3 A security vulnerability has been detected in Campcodes Online Loan Management System 1.0. Affected is an unknown function of the file /ajax.php?action=save_borrower. The manipulation of the argument lastname…
CVE-2025-9502 2025-08-27 HIGH 7.3 A weakness has been identified in Campcodes Online Loan Management System 1.0. This impacts an unknown function of the file /ajax.php?action=save_payment. Executing manipulation of the argument loan_id can…
CVE-2025-55443 2025-08-26 CRITICAL 9.1 Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details (IP/port) that are stored in plaintext within log files on the device's…
CVE-2025-52353 2025-08-26 CRITICAL 9.8 An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type…
CVE-2025-43882 2025-08-27 HIGH 7.8 Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership vulnerability. A local low-privileged attacker could potentially exploit this vulnerability leading to Unauthorized Access.
CVE-2025-43730 2025-08-27 HIGH 8.4 Dell ThinOS 10, versions prior to 2508_10.0127, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A local unauthenticated user could potentially exploit this…
CVE-2025-43729 2025-08-27 HIGH 7.8 Dell ThinOS 10, versions prior to 2508_10.0127, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A local low-privileged attacker could potentially exploit this vulnerability leading to Elevation…
CVE-2025-43728 2025-08-27 CRITICAL 9.6 Dell ThinOS 10, versions prior to 2508_10.0127, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism…
CVE-2025-22411 2025-08-26 HIGH 8.8 In process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution with…
CVE-2025-22410 2025-08-26 HIGH 8.4 In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no…
CVE-2025-22409 2025-08-26 HIGH 8.4 In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with…
CVE-2025-22408 2025-08-26 CRITICAL 9.8 In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no…
CVE-2025-22407 2025-08-26 MEDIUM 5.5 In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local information disclosure with no…
CVE-2025-22406 2025-08-26 HIGH 8.4 In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution due to a use after free. This could lead to local escalation of privilege with…
CVE-2025-22405 2025-08-26 HIGH 8.4 In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no…
CVE-2025-22404 2025-08-26 HIGH 8.4 In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with…
CVE-2025-22403 2025-08-26 CRITICAL 9.8 In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no…
CVE-2025-0093 2025-08-26 HIGH 7.5 In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission check. This could lead to remote information disclosure with no additional execution…
CVE-2025-0092 2025-08-26 MEDIUM 6.5 In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficient UI. This could lead to remote (proximal/adjacent) information disclosure with no additional execution…
CVE-2025-0086 2025-08-26 MEDIUM 6.2 In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could lead to local information disclosure with no…
CVE-2025-0083 2025-08-26 MEDIUM 4.0 In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This could lead to local information disclosure with no…
CVE-2025-0080 2025-08-26 HIGH 7.8 In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with…
CVE-2025-0079 2025-08-26 HIGH 7.8 In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This could lead to…
CVE-2025-0078 2025-08-26 HIGH 8.8 In main of main.cpp, there is a possible way to bypass SELinux due to a logic error in the code. This could lead to local escalation of privilege…
CVE-2024-49740 2025-08-26 MEDIUM 5.5 In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User…
CVE-2024-35203 2025-08-26 MEDIUM 6.1 Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part of its name, that is uploaded via the Mahara filebrowser…
CVE-2025-9526 2025-08-27 HIGH 8.8 A vulnerability has been found in Linksys E1700 1.0.0.4.003. Affected by this issue is the function setSysAdm of the file /goform/setSysAdm. Such manipulation of the argument rm_port leads…
CVE-2025-9525 2025-08-27 HIGH 8.8 A flaw has been found in Linksys E1700 1.0.0.4.003. Affected by this vulnerability is the function setWan of the file /goform/setWan. This manipulation of the argument DeviceName/lanIp causes…
« Anterior Página 523 de 3943 Siguiente »