Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2025-21044 2025-10-10 MEDIUM 5.7 Out-of-bounds write in fingerprint trustlet prior to SMR Oct-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
CVE-2025-61871 2025-10-10 MEDIUM 6.7 NAS Navigator2 Windows version by BUFFALO INC. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the…
CVE-2025-11570 2025-10-10 MEDIUM 4.6 Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficient filtering of data. **Note:** This is exploitable only if the code is…
CVE-2025-11569 2025-10-10 HIGH 7.5 All versions of the package cross-zip are vulnerable to Directory Traversal via consecutive usage of zipSync() and unzipSync () functions that allow arguments such as __dirname. An attacker…
CVE-2025-11450 2025-10-10 N/A 0.0 ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers…
CVE-2025-11449 2025-10-10 N/A 0.0 ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers…
CVE-2025-11525 2025-10-09 HIGH 8.8 A vulnerability has been found in Tenda AC7 15.03.06.44. Impacted is an unknown function of the file /goform/SetUpnpCfg. Such manipulation of the argument upnpEn leads to stack-based buffer…
CVE-2025-11523 2025-10-09 MEDIUM 6.3 A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It…
CVE-2025-11524 2025-10-09 HIGH 8.8 A flaw has been found in Tenda AC7 15.03.06.44. This issue affects some unknown processing of the file /goform/SetDDNSCfg. This manipulation of the argument ddnsEn causes stack-based buffer…
CVE-2025-11526 2025-10-09 HIGH 8.8 A vulnerability was found in Tenda AC7 15.03.06.44. The affected element is an unknown function of the file /goform/WifiMacFilterSet. Performing manipulation of the argument wifi_chkHz results in stack-based…
CVE-2025-11528 2025-10-09 HIGH 8.8 A vulnerability was identified in Tenda AC7 15.03.06.44. This affects an unknown function of the file /goform/saveAutoQos. The manipulation of the argument enable leads to stack-based buffer overflow.…
CVE-2025-11527 2025-10-09 HIGH 8.8 A vulnerability was determined in Tenda AC7 15.03.06.44. The impacted element is an unknown function of the file /goform/fast_setting_pppoe_set. Executing manipulation of the argument Password can lead to…
CVE-2025-11530 2025-10-09 MEDIUM 6.3 A weakness has been identified in code-projects Online Complaint Site 1.0. Affected is an unknown function of the file /cms/admin/state.php. This manipulation of the argument state causes sql…
CVE-2025-61926 2025-10-09 N/A 0.0 Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be…
CVE-2016-15047 2025-10-09 N/A 0.0 AVTECH devices that include the CloudSetup.cgi management endpoint are vulnerable to authenticated OS command injection. The `exefile` parameter in CloudSetup.cgi is passed to the underlying system command execution…
CVE-2025-62240 2025-10-09 N/A 0.0 Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update…
CVE-2025-61783 2025-10-09 N/A 0.0 Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was…
CVE-2025-61601 2025-10-09 HIGH 7.5 BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server…
CVE-2025-59286 2025-10-09 MEDIUM 6.5 Copilot Spoofing Vulnerability
CVE-2025-59272 2025-10-09 MEDIUM 6.5 Copilot Spoofing Vulnerability
CVE-2025-59271 2025-10-09 HIGH 8.7 Redis Enterprise Elevation of Privilege Vulnerability
CVE-2025-59252 2025-10-09 MEDIUM 6.5 M365 Copilot Spoofing Vulnerability
CVE-2025-59247 2025-10-09 HIGH 8.8 Azure PlayFab Elevation of Privilege Vulnerability
CVE-2025-59246 2025-10-09 CRITICAL 9.8 Azure Entra ID Elevation of Privilege Vulnerability
CVE-2025-59218 2025-10-09 CRITICAL 9.6 Azure Entra ID Elevation of Privilege Vulnerability
CVE-2025-55321 2025-10-09 HIGH 8.7 Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an authorized attacker to perform spoofing over a network.
CVE-2025-35062 2025-10-09 MEDIUM 5.3 Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an unauthenticated attacker to exploit additional vulnerabilities that require authentication.
CVE-2025-35061 2025-10-09 MEDIUM 5.9 Newforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2…
CVE-2025-35060 2025-10-09 MEDIUM 5.5 Newforma Info Exchange (NIX) provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that…
CVE-2025-35059 2025-10-09 MEDIUM 4.3 Newforma Info Exchange (NIX) '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect via the 'nhl' parameter.
CVE-2025-35058 2025-10-09 MEDIUM 5.9 Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2…
CVE-2025-35057 2025-10-09 MEDIUM 5.3 Newforma Info Exchange (NIX) '/RemoteWeb/IntegrationServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2…
CVE-2025-35056 2025-10-09 MEDIUM 5.0 Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted file path and returns an image of the specified file. An authenticated attacker can read arbitrary files subject to…
CVE-2025-35055 2025-10-09 HIGH 8.8 Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an arbitrary file to any location writable by the NIX application. An attacker can upload and run…
CVE-2025-35054 2025-10-09 MEDIUM 5.3 Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated…
CVE-2025-35053 2025-10-09 MEDIUM 6.4 Newforma Info Exchange (NIX) accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'DownloadExportedPDF' command that allow an authenticated user to read and delete arbitrary files with 'NT AUTHORITY\NetworkService' privileges. In…
CVE-2025-35052 2025-10-09 MEDIUM 5.3 Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, potentially bypassing authentication and authorization,…
CVE-2025-35051 2025-10-09 CRITICAL 9.8 Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges.…
CVE-2025-35050 2025-10-09 CRITICAL 9.8 Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. The vulnerable endpoint…
CVE-2025-34248 2025-10-09 N/A 0.0 D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker…
CVE-2025-11558 2025-10-09 HIGH 7.3 A vulnerability was found in code-projects E-Commerce Website 1.0. Impacted is an unknown function of the file /pages/user_index_search.php. Performing manipulation of the argument Search results in sql injection.…
CVE-2025-11557 2025-10-09 HIGH 7.3 A vulnerability has been found in projectworlds Gate Pass Management System 1.0. This issue affects some unknown processing of the file /add-pass.php. Such manipulation of the argument fullname…
CVE-2025-60267 2025-10-09 MEDIUM 6.5 In xckk v9.6, there is a SQL injection vulnerability in which the cond parameter in notice/list is not securely filtered, resulting in a SQL injection vulnerability.
CVE-2025-60304 2025-10-09 MEDIUM 6.1 code-projects Simple Scheduling System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Subject Description field.
CVE-2025-60266 2025-10-09 MEDIUM 6.5 In xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in address/list is not securely filtered, resulting in a SQL injection vulnerability.
CVE-2025-60265 2025-10-09 MEDIUM 6.5 In xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in user/list is not securely filtered, resulting in a SQL injection vulnerability.
CVE-2025-11554 2025-10-09 MEDIUM 6.3 A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User…
CVE-2025-56426 2025-10-09 MEDIUM 6.5 An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logic fails to validate quantity inputs…
CVE-2025-11551 2025-10-09 MEDIUM 6.3 A vulnerability was determined in code-projects Student Result Manager 1.0. This affects an unknown function of the file src/students/Database.java. This manipulation of the argument roll/name/gpa causes sql injection.…
CVE-2025-11550 2025-10-09 MEDIUM 6.5 A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of…
« Anterior Página 97 de 3645 Siguiente »