Explore CVE records

CritPublished 30 Jan 2025, 02:52 WIB

CVE-2025-20061

mySCADA myPRO Manager OS Command Injection

mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.

Excerpt language: en.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated13 Feb 2025, 02:51 WIB

Official record

CritPublished 30 Jan 2025, 02:46 WIB

CVE-2025-20014

mySCADA myPRO Manager OS Command Injection

mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.

Excerpt language: en.

MedPublished 30 Jan 2025, 01:59 WIB

CVE-2024-48852

Information disclosures

Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This issue affects FLXEON through <= 9.3.4.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated13 Feb 2025, 02:51 WIB

Official record

HighPublished 30 Jan 2025, 01:24 WIB

CVE-2024-10001

Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling

A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the identity property in the message handling function. This enabled the exfiltration of sensitive data by manipulating the DOM, including authentication tokens. To execu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated12 Feb 2025, 23:49 WIB

Official record

HighPublished 30 Jan 2025, 01:23 WIB

CVE-2024-48849

Authentication and Authorization Issues

Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through <= 9.3.4.

Excerpt language: en.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated30 Jan 2025, 01:46 WIB

Official record

MedPublished 30 Jan 2025, 00:49 WIB

CVE-2025-24790

Snowflake JDBC uses insecure temporary credential cache file permissions

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. On Linux systems, when temporary credential caching is enabled, the Snowflake JDBC Driver will cache temporary c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated13 Feb 2025, 02:51 WIB

Official record

HighPublished 30 Jan 2025, 00:46 WIB

CVE-2025-24789

Snowflake JDBC allows an untrusted search path on Windows

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write access to a directory …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated13 Feb 2025, 02:51 WIB

Official record

MedPublished 30 Jan 2025, 00:40 WIB

CVE-2025-24882

regclient may ignore pinned manifest digests

regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1.

Excerpt language: en.

CVSS5.2v3.1KEVNot listedEPSSPresentUpdated30 Jan 2025, 00:52 WIB

Official record

MedPublished 29 Jan 2025, 23:59 WIB

CVE-2025-24791

snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions

snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This vulnerability affects versions …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated30 Jan 2025, 00:08 WIB

Official record

MedPublished 29 Jan 2025, 23:37 WIB

CVE-2023-35907

IBM Aspera Faspex information disclosure

IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

Excerpt language: en.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated12 Feb 2025, 23:47 WIB

Official record

MedPublished 29 Jan 2025, 23:36 WIB

CVE-2023-37413

IBM Aspera Faspex information disclosure

IBM Aspera Faspex 5.0.0 through 5.0.10 could disclose sensitive username information due to an observable response discrepancy.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated12 Feb 2025, 23:39 WIB

Official record

MedPublished 29 Jan 2025, 23:35 WIB

CVE-2023-37398

IBM Aspera Faspex information disclosure

IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

Excerpt language: en.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated12 Feb 2025, 23:47 WIB

Official record

MedPublished 29 Jan 2025, 23:34 WIB

CVE-2023-37412

IBM Aspera Faspex improper access control

IBM Aspera Faspex 5.0.0 through 5.0.10 could allow a privileged user to make system changes without proper access controls.

Excerpt language: en.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated12 Feb 2025, 23:48 WIB

Official record

MedPublished 29 Jan 2025, 22:27 WIB

CVE-2025-24792

Snowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Error

Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects (PDO) extension to connect to the Snowflake database. Snowflake discovered and remediated a vulnerability in the Snowflake PHP PDO Driver where executing unsupported queries like PUT or GET on stages causes a signed-to-unsigned conversion error that cr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated13 Feb 2025, 02:51 WIB

Official record

MedPublished 29 Jan 2025, 22:22 WIB

CVE-2025-24374

Twig fixes a security issue where escaping was missing when using null coalesce operator (??)

Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Jan 2025, 22:44 WIB

Official record

LowPublished 29 Jan 2025, 18:52 WIB

CVE-2024-54462

Unsanitized Filenames in Flutter package image_picker_android Allow File Overwrites

The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using your app and could potentially override inter…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated13 Feb 2025, 02:51 WIB

Official record

LowPublished 29 Jan 2025, 18:51 WIB

CVE-2024-54461

Unsanitized Filenames in Flutter package file_selector_android Allow File Overwrites

The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could potentially override in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated13 Feb 2025, 02:51 WIB

Official record

HighPublished 29 Jan 2025, 18:14 WIB

CVE-2024-41140

Improper Authorization

Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated13 Feb 2025, 02:51 WIB

Official record

MedPublished 29 Jan 2025, 18:10 WIB

CVE-2025-0353

Divi Torque Lite <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:26 WIB

Official record

MedPublished 29 Jan 2025, 18:10 WIB

CVE-2024-13561

Target Video Easy Publish <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via brid_override_yt Shortcode

The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's brid_override_yt shortcode in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:23 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage