Protégez vos données, renforcez Votre Cybersécurité

CVE-2025-41240 - CRITICAL
24/07/2025

Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets by accessing specific URLs if the application is exposed externally. The issue affects deployments u...

CVE-2025-7437 - CRITICAL
24/07/2025

The Ebook Store plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ebook_store_save_form function in all versions up to, and including, 5.8012. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

fileinclusionOWSAP: A04

>> Plus d'informations avec CVE Find

CVE-2025-7852 - CRITICAL
24/07/2025

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls move_uploaded_file() on client‐supplied files without restricting allowed extensions or MIME types, nor sanitizing the fi...

fileinclusionOWSAP: A04

>> Plus d'informations avec CVE Find

CVE-2016-15044 - CRITICAL
23/07/2025

A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorservices module. An unauthenticated remote attacker can exploit this issue by sending a specially crafted serialized PHP object in the kdata GET parameter to the redirectWidgetCmd endpoint. Successful exploitation leads to execution of arbitrary...

codeinjectionOWSAP: A08OWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-4700 - HIGH
23/07/2025

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS.

crosssitescriptingOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-33076 - HIGH
23/07/2025

IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.

overflow

>> Plus d'informations avec CVE Find

CVE-2025-33077 - HIGH
23/07/2025

IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.

overflow

>> Plus d'informations avec CVE Find

CVE-2010-10012 - HIGH
23/07/2025

A path traversal vulnerability exists in httpdasm version 0.92, a lightweight Windows HTTP server, that allows unauthenticated attackers to read arbitrary files on the host system. By sending a specially crafted GET request containing a sequence of URL-encoded backslashes and directory traversal patterns, an attacker can escape the web root and access sensitive files outside of the intended direc...

directorytraversalOWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2015-10141 - CRITICAL
23/07/2025

An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke syste...

oscommandinjectionauthorisationproblemOWSAP: A03OWSAP: A07

>> Plus d'informations avec CVE Find

CVE-2016-15045 - HIGH
23/07/2025

A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technology Co., Ltd.). In versions 0.9.53-1 (Deepin 15.5) and 0.9.66-1 (Deepin 15.7), the D-Bus configuration permits any user in the sudo group to invoke the InstallPackage method without password authentication. By default, the first user created ...

authorisationproblempriviliegemanagementOWSAP: A07OWSAP: A04

>> Plus d'informations avec CVE Find

CVE-2017-20198 - CRITICAL
23/07/2025

The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root p...

CVE-2018-25113 - HIGH
23/07/2025

An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter. Successful exploitation can reveal sensitive files accessible by the web server user.

directorytraversalOWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2018-25114 - CRITICAL
23/07/2025

A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install_4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file....

fileinclusioncodeinjectionOWSAP: A04OWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2022-4978 - CRITICAL
23/07/2025

Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default configuration. The server exposes a custom UDP-based control protocol that accepts remote keyboard input events without verification. An attacker on the same network can issue a sequence of keystroke commands to launch a system shell and exec...

authorisationproblemoscommandinjectionOWSAP: A07OWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-40599 - CRITICAL
23/07/2025

An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution.

fileinclusionOWSAP: A04

>> Plus d'informations avec CVE Find

CVE-2025-50127 - HIGH
23/07/2025

A SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands.

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-54294 - CRITICAL
23/07/2025

A SQLi vulnerability in Komento component 4.0.0-4.0.7for Joomla was discovered. The issue allows unprivileged users to execute arbitrary SQL commands.

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-53882 - CRITICAL
23/07/2025

A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSEs mailman3 package allows potential escalation from mailman to root. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.

OWSAP: A04

>> Plus d'informations avec CVE Find

CVE-2025-41683 - HIGH
23/07/2025

An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint event_mail_test).

oscommandinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-41684 - HIGH
23/07/2025

An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint tls_iotgen_setting).

oscommandinjectionOWSAP: A03

>> Plus d'informations avec CVE Find