Explore CVE records

MedPublished 29 Aug 2025, 00:00 WIB

CVE-2025-31977

A cryptographic weakness has been identified in the HCL BigFix Service Management (SM)

HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2025, 00:14 WIB

Official record

MedPublished 28 Aug 2025, 23:50 WIB

CVE-2025-31972

HCL BigFix Service Management (SM) is affected by a Sensitive Information Exposure vulnerability

HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.

Excerpt language: en.

MedPublished 28 Aug 2025, 23:48 WIB

CVE-2025-58335

In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 information disclosure was possible via search_project function

Excerpt language: en.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated29 Aug 2025, 00:14 WIB

Official record

HighPublished 28 Aug 2025, 23:48 WIB

CVE-2025-58334

In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

CritKEVPublished 28 Aug 2025, 23:45 WIB

CVE-2025-57819

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS10v4.0KEVListedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

MedPublished 28 Aug 2025, 23:32 WIB

CVE-2025-57759

Contao has improper privilege management for page and article fields

Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2025, 00:16 WIB

Official record

MedPublished 28 Aug 2025, 23:32 WIB

CVE-2025-57758

Contao has improper access control in the back end voters

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2025, 00:20 WIB

Official record

MedPublished 28 Aug 2025, 23:32 WIB

CVE-2025-57757

Contao discloses information in the news module

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not adding protec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2025, 00:48 WIB

Official record

MedPublished 28 Aug 2025, 23:31 WIB

CVE-2025-57756

Contao discloses sensitive information in the front end search index

Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. This issue has been patched in versions 4.13.56, 5.3.38, and 5.6.1. A workaround involves d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2025, 00:49 WIB

Official record

MedPublished 28 Aug 2025, 22:52 WIB

CVE-2025-25010

Kibana privilege escalation via reporting_user role

Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

HighPublished 28 Aug 2025, 22:49 WIB

CVE-2024-13986

Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE

Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation res…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:14 WIB

Official record

HighPublished 28 Aug 2025, 22:33 WIB

CVE-2025-57767

Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an Authorization header that contains a realm that wasn't in a previous 401 response's WWW-Authenticate header, or an Authorization header with an incorrect realm w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Aug 2025, 00:12 WIB

Official record

MedPublished 28 Aug 2025, 22:08 WIB

CVE-2025-54995

Asterisk remotely exploitable leak of RTP UDP ports and internal resources

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 00:45 WIB

Official record

MedPublished 28 Aug 2025, 21:56 WIB

CVE-2024-48908

lychee-action vulnerable to arbitrary code injection in composite action

lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 03:11 WIB

Official record

HighPublished 28 Aug 2025, 21:47 WIB

CVE-2025-8067

Udisks: out-of-bounds read in udisks daemon

A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifyi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated30 Jun 2026, 03:47 WIB

Official record

MedPublished 28 Aug 2025, 21:09 WIB

CVE-2024-49790

IBM Watson Studio on Cloud Pak for Data cross-site scripting

IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Excerpt language: en.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Aug 2025, 21:46 WIB

Official record

HighPublished 28 Aug 2025, 21:01 WIB

CVE-2025-9578

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40734.

Excerpt language: en.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

MedPublished 28 Aug 2025, 19:59 WIB

CVE-2025-58127

Lack of TLS validation in plugin Dell Powerscale on Checkmk Exchange

Improper Certificate Validation in Checkmk Exchange plugin Dell Powerscale allows attackers in MitM position to intercept traffic.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Aug 2025, 20:12 WIB

Official record

MedPublished 28 Aug 2025, 19:59 WIB

CVE-2025-58126

Lack of TLS validation in plugin VMware vSAN on Checkmk Exchange

Improper Certificate Validation in Checkmk Exchange plugin VMware vSAN allows attackers in MitM position to intercept traffic.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Aug 2025, 20:14 WIB

Official record

MedPublished 28 Aug 2025, 19:59 WIB

CVE-2025-58125

Lack of TLS validation in plugin Freebox v6 agent on Checkmk Exchange

Improper Certificate Validation in Checkmk Exchange plugin Freebox v6 agent allows attackers in MitM position to intercept traffic.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Aug 2025, 20:17 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage