Explore CVE records

MedPublished 22 May 2025, 20:30 WIB

CVE-2025-2853

Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of proper validation in GitLab could allow an authenticated user to cause a denial of service condition.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 21:50 WIB

Official record

MedPublished 22 May 2025, 20:30 WIB

CVE-2025-3111

Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in the Kubernetes integration could allow an authenticated user to cause denial of service..

Excerpt language: en.

MedPublished 22 May 2025, 20:30 WIB

CVE-2025-4979

Insufficient Granularity of Access Control in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables (that they did not author) in the WebUI, by simply creating their own variable and observing the HTTP response.

Excerpt language: en.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 21:21 WIB

Official record

HighPublished 22 May 2025, 19:47 WIB

CVE-2025-3945

Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: bef…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 20:17 WIB

Official record

HighPublished 22 May 2025, 19:44 WIB

CVE-2025-3944

Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, bef…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 20:17 WIB

Official record

MedPublished 22 May 2025, 19:42 WIB

CVE-2025-3943

Use of GET Request Method With sensitive Query Strings

Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 20:19 WIB

Official record

MedPublished 22 May 2025, 19:40 WIB

CVE-2025-3942

Improper Output Neutralization for Logs

Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 20:36 WIB

Official record

MedPublished 22 May 2025, 19:38 WIB

CVE-2025-3941

Improper Handling of Windows: DATA Alternate Data Stream

Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 20:52 WIB

Official record

MedPublished 22 May 2025, 19:35 WIB

CVE-2025-3940

Improper Use of Validation Framework

Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 21:00 WIB

Official record

MedPublished 22 May 2025, 19:33 WIB

CVE-2025-3939

Observable Response Discrepancy

Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 21:02 WIB

Official record

MedPublished 22 May 2025, 19:32 WIB

CVE-2025-3938

Missing Cryptographic Step

Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 21:10 WIB

Official record

MedPublished 22 May 2025, 19:31 WIB

CVE-2025-5075

FreeFloat FTP Server DEBUG Command buffer overflow

A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component DEBUG Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 May 2025, 21:16 WIB

Official record

HighPublished 22 May 2025, 19:27 WIB

CVE-2025-46714

Sandboxie has Pool Buffer Overflow in SbieDrv.sys API (API_GET_SECURE_PARAM)

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to 1.15.12, API_GET_SECURE_PARAM has an arithmetic overflow leading to a small memory allocation and then a extremely large copy into the small allocation. Version 1.15.12 fixes …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 21:21 WIB

Official record

HighPublished 22 May 2025, 19:23 WIB

CVE-2025-3937

Use of Password Hash with Insufficient Computational Effort

Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security:…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 21:43 WIB

Official record

HighPublished 22 May 2025, 19:23 WIB

CVE-2025-46713

Sandboxie has Pool Buffer Overflow in SbieDrv.sys API (API_SET_SECURE_PARAM)

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 0.0.1 and prior to 1.15.12, API_SET_SECURE_PARAM may have an arithmetic overflow deep in the memory allocation subsystem that would lead to a smaller allocation than requested, and a buffer over…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated22 May 2025, 22:12 WIB

Official record

HighPublished 22 May 2025, 19:23 WIB

CVE-2025-2272

Privilege Escalation and Arbitrary code execution in F1E Endpoint

Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issue affects FIE Endpoint: before 25.05.

Excerpt language: en.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated22 May 2025, 22:34 WIB

Official record

MedPublished 22 May 2025, 19:20 WIB

CVE-2025-3936

Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated23 May 2025, 00:29 WIB

Official record

MedPublished 22 May 2025, 19:00 WIB

CVE-2025-5074

FreeFloat FTP Server PROMPT Command buffer overflow

A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component PROMPT Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 May 2025, 00:46 WIB

Official record

MedPublished 22 May 2025, 18:00 WIB

CVE-2025-5073

FreeFloat FTP Server MKDIR Command buffer overflow

A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. This issue affects some unknown processing of the component MKDIR Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 May 2025, 00:52 WIB

Official record

HighPublished 22 May 2025, 17:39 WIB

CVE-2025-41403

SQL Injection

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data.

Excerpt language: en.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated23 May 2025, 01:13 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage