CVE News Feed

• CVE-2025-2394 - Ecovacs Home Android and iOS Mobile Apps Stored XSS Vulnerability

  CVE ID :CVE-2025-2394
  Published : May 23, 2025, 1:15 a.m. | 1 hour, 4 minutes ago
  Description :Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leading to sensitive data disclosure.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-4692 - ABUP Cloud Update Platform JWT Privilege Escalation Vulnerability

  CVE ID :CVE-2025-4692
  Published : May 23, 2025, 12:15 a.m. | 2 hours, 4 minutes ago
  Description :Actors can use a maliciously crafted JavaScript object notation (JSON) web token (JWT) to perform privilege escalation by submitting the malicious JWT to a vulnerable method exposed on the cloud platform. If the exploit is successful, the user can escalate privileges to access any device managed by the ABUP Cloud Update Platform.
  Severity: 6.8 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-4642 - CVE-2016-100005: Apache Struts Remote Code Execution

  CVE ID :CVE-2025-4642
  Published : May 22, 2025, 11:15 p.m. | 3 hours, 4 minutes ago
  Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-4562 - "Apache HTTP Server Remote Code Execution"

  CVE ID :CVE-2025-4562
  Published : May 22, 2025, 11:15 p.m. | 3 hours, 4 minutes ago
  Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-4338 - Lantronix Device Installer XXE Injection Vulnerability

  CVE ID :CVE-2025-4338
  Published : May 22, 2025, 11:15 p.m. | 3 hours, 4 minutes ago
  Description :Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain credentials, access these network devices, and modify their configurations. An attacker may also gain access to the host running the Device Installer software or the password hash of the user running the application.
  Severity: 6.8 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-48371 - OpenFGA Authorization Bypass Vulnerability

  CVE ID :CVE-2025-48371
  Published : May 22, 2025, 11:15 p.m. | 3 hours, 4 minutes ago
  Description :OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples’s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-4975 - Samsung Device Power Settings Privilege Escalation Vulnerability

  CVE ID :CVE-2025-4975
  Published : May 22, 2025, 10:15 p.m. | 4 hours, 4 minutes ago
  Description :When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power settings of that device.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-47181 - Microsoft Edge Link Following Privilege Escalation Vulnerability

  CVE ID :CVE-2025-47181
  Published : May 22, 2025, 10:15 p.m. | 4 hours, 4 minutes ago
  Description :Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
  Severity: 8.8 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-48374 - Zot Keycloak Client Secret Disclosure

  CVE ID :CVE-2025-48374
  Published : May 22, 2025, 9:15 p.m. | 5 hours, 3 minutes ago
  Description :zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-48373 - Schule Client-Side Role Hijacking Vulnerability

  CVE ID :CVE-2025-48373
  Published : May 22, 2025, 9:15 p.m. | 5 hours, 3 minutes ago
  Description :Schule is open-source school management system software. The application relies on client-side JavaScript (index.js) to redirect users to different panels based on their role. Prior to version 1.0.1, this implementation poses a serious security risk because it assumes that the value of data.role is trustworthy on the client side. Attackers can manipulate JavaScript in the browser (e.g., via browser dev tools or intercepting API responses) and set data.role to any arbitrary value (e.g., "admin"), gaining unauthorized access to restricted areas of the application.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-48372 - Schule One-Time Password Brute-Force Vulnerability

  CVE ID :CVE-2025-48372
  Published : May 22, 2025, 9:15 p.m. | 5 hours, 3 minutes ago
  Description :Schule is open-source school management system software. The generateOTP() function generates a 4-digit numeric One-Time Password (OTP). Prior to version 1.0.1, even if a secure random number generator is used, the short length and limited range (1000–9999) results in only 9000 possible combinations. This small keyspace makes the OTP highly vulnerable to brute-force attacks, especially in the absence of strong rate-limiting or lockout mechanisms. Version 1.0.1 fixes the issue.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2024-5962 - WSO2 WSO2 Reflected Cross-Site Scripting (XSS) Vulnerability

  CVE ID :CVE-2024-5962
  Published : May 22, 2025, 8:15 p.m. | 6 hours, 4 minutes ago
  Description :A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input. A malicious actor can exploit this vulnerability to inject arbitrary JavaScript into the authentication flow, potentially leading to UI modifications, redirections to malicious websites, or data exfiltration from the browser. While this issue could allow an attacker to manipulate the user’s browser, session-related sensitive cookies remain protected with the httpOnly flag, preventing session hijacking.
  Severity: 6.1 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2003-5004 - Apache HTTP Server Information Disclosure

  CVE ID :CVE-2003-5004
  Published : May 22, 2025, 8:15 p.m. | 6 hours, 4 minutes ago
  Description :Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
  Severity: 0.0 | NA
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2024-7487 - WSO2 Identity Server Bypass Authentication Vulnerability

  CVE ID :CVE-2024-7487
  Published : May 22, 2025, 7:15 p.m. | 7 hours, 3 minutes ago
  Description :An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid object is passed. Exploitation of this vulnerability could enable malicious actors to circumvent the client verification mechanism, compromising the integrity of the authentication process.
  Severity: 5.8 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2024-7103 - WSO2 Identity Server Reflected XSS

  CVE ID :CVE-2024-7103
  Published : May 22, 2025, 7:15 p.m. | 7 hours, 3 minutes ago
  Description :A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation. A malicious actor can exploit this vulnerability to inject arbitrary JavaScript into the login flow, potentially leading to UI modifications, redirections to malicious websites, or data exfiltration from the browser. While this issue could allow an attacker to manipulate the user’s browser, session-related sensitive cookies remain protected with the httpOnly flag, preventing session hijacking.
  Severity: 4.6 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2024-6914 - WSO2 SOAP Unauthorized Account Takeover Vulnerability

  CVE ID :CVE-2024-6914
  Published : May 22, 2025, 7:15 p.m. | 7 hours, 3 minutes ago
  Description :An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges. This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the "/services" context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the "Security Guidelines for Production Deployment" by disabling exposure to untrusted networks.
  Severity: 9.8 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2024-51553 - ASPECT Predictable Filename Information Disclosure Vulnerability

  CVE ID :CVE-2024-51553
  Published : May 22, 2025, 7:15 p.m. | 7 hours, 3 minutes ago
  Description :Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
  Severity: 6.5 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2024-51552 - ASPECT Password Weakness

  CVE ID :CVE-2024-51552
  Published : May 22, 2025, 7:15 p.m. | 7 hours, 3 minutes ago
  Description :Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
  Severity: 6.0 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2024-48848 - Aspect Disk Overutilization Vulnerability

  CVE ID :CVE-2024-48848
  Published : May 22, 2025, 7:15 p.m. | 7 hours, 3 minutes ago
  Description :Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
  Severity: 6.5 | MEDIUM
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2024-41199 - Ocuco Innovation JOBMANAGER.EXE Authentication Bypass Privilege Escalation Vulnerability

  CVE ID :CVE-2024-41199
  Published : May 22, 2025, 7:15 p.m. | 7 hours, 3 minutes ago
  Description :An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
  Severity: 7.2 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...