Lista CVE - 2025 / Dicembre
Visualizzazione 3001 - 3100 di 3706 CVE per Dicembre 2025 (Pagina 31 di 38)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2025-68305 | 2025-12-16 | Bluetooth: hci_sock: Prevent race in socket write iter and sock bind |
| CVE-2025-68306 | 2025-12-16 | Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface |
| CVE-2025-68307 | 2025-12-16 | can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs |
| CVE-2025-68308 | 2025-12-16 | can: kvaser_usb: leaf: Fix potential infinite loop in command parsers |
| CVE-2025-62329 | 2025-12-16 | HCL DevOps Deploy / HCL Launch is susceptible to an insufficient session expiration vulnerability |
| CVE-2025-14432 | 2025-12-16 | Poly Video - Sensitive Data Might Be Written to Log File |
| CVE-2025-68162 | 2025-12-16 | In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration |
| CVE-2025-68163 | 2025-12-16 | In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page |
| CVE-2025-68164 | 2025-12-16 | In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test |
| CVE-2025-68165 | 2025-12-16 | In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup |
| CVE-2025-68166 | 2025-12-16 | In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab |
| CVE-2025-68267 | 2025-12-16 | In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token |
| CVE-2025-68268 | 2025-12-16 | In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page |
| CVE-2025-68269 | 2025-12-16 | In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH |
| CVE-2025-68309 | 2025-12-16 | PCI/AER: Fix NULL pointer access by aer_info |
| CVE-2025-68310 | 2025-12-16 | s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump |
| CVE-2025-68311 | 2025-12-16 | tty: serial: ip22zilog: Use platform device for probing |
| CVE-2025-68312 | 2025-12-16 | usbnet: Prevents free active kevent |
| CVE-2025-68313 | 2025-12-16 | x86/CPU/AMD: Add RDSEED fix for Zen5 |
| CVE-2025-68314 | 2025-12-16 | drm/msm: make sure last_fence is always updated |
| CVE-2025-68315 | 2025-12-16 | f2fs: fix to detect potential corrupted nid in free_nid_list |
| CVE-2025-68316 | 2025-12-16 | scsi: ufs: core: Fix invalid probe error return value |
| CVE-2025-68317 | 2025-12-16 | io_uring/zctx: check chained notif contexts |
| CVE-2025-68318 | 2025-12-16 | clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL |
| CVE-2025-68319 | 2025-12-16 | netconsole: Acquire su_mutex before navigating configs hierarchy |
| CVE-2025-68320 | 2025-12-16 | lan966x: Fix sleeping in atomic context |
| CVE-2025-68321 | 2025-12-16 | page_pool: always add GFP_NOWARN for ATOMIC allocations |
| CVE-2025-68322 | 2025-12-16 | parisc: Avoid crash due to unaligned access in unwinder |
| CVE-2025-10450 | 2025-12-16 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional (Core Libraries) allows Sniffing Network Traffic. |
| CVE-2025-37164 | 2025-12-16 | A remote code execution issue exists in HPE OneView. |
| CVE-2025-59935 | 2025-12-16 | GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page |
| CVE-2025-68116 | 2025-12-16 | FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling |
| CVE-2025-68130 | 2025-12-16 | tRPC has possible prototype pollution in `experimental_nextAppDirCaller` |
| CVE-2023-53894 | 2025-12-16 | phpfm 1.7.9 Authentication Bypass via Type Juggling Vulnerability |
| CVE-2023-53897 | 2025-12-16 | Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Comments |
| CVE-2023-53898 | 2025-12-16 | Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Configuration |
| CVE-2023-53899 | 2025-12-16 | PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection |
| CVE-2023-53901 | 2025-12-16 | WBCE CMS 1.6.1 Cross-Site Scripting and Open Redirect Vulnerability |
| CVE-2023-53902 | 2025-12-16 | WebsiteBaker 2.13.3 Directory Traversal via Media Delete Endpoint |
| CVE-2023-53903 | 2025-12-16 | WebsiteBaker 2.13.3 Stored Cross-Site Scripting via SVG File Upload |
| CVE-2023-53895 | 2025-12-16 | PimpMyLog 1.7.14 Improper Access Control via Account Creation Endpoint |
| CVE-2023-53896 | 2025-12-16 | D-Link DAP-1325 Hardware A1 Unauthenticated Configuration Download |
| CVE-2023-53900 | 2025-12-16 | Spip 4.1.10 Admin Account Spoofing via Malicious SVG Upload |
| CVE-2025-33212 | 2025-12-16 | NVIDIA NeMo Framework contains a vulnerability in model loading that could allow an attacker to exploit improper control mechanisms if a user loads a maliciously crafted file. A successful exploit... |
| CVE-2025-33226 | 2025-12-16 | NVIDIA NeMo Framework for all platforms contains a vulnerability where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to... |
| CVE-2025-33210 | 2025-12-16 | NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to code execution. |
| CVE-2025-33225 | 2025-12-16 | NVIDIA Resiliency Extension for Linux contains a vulnerability in log aggregation, where an attacker could cause predictable log-file names. A successful exploit of this vulnerability may lead to escalation of... |
| CVE-2025-33235 | 2025-12-16 | NVIDIA Resiliency Extension for Linux contains a vulnerability in the checkpointing core, where an attacker may cause a race condition. A successful exploit of this vulnerability might lead to information... |
| CVE-2025-68142 | 2025-12-16 | PyMdown Extensions has ReDOS bug in Figure Capture extension |
| CVE-2025-46294 | 2025-12-16 | To enhance security, the FileMaker Server 22.0.4 installer now includes an option to disable IIS short filename enumeration by setting NtfsDisable8dot3NameCreation in the Windows registry. This prevents attackers from using... |
| CVE-2025-46295 | 2025-12-16 | Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Because some interpolators could trigger actions like... |
| CVE-2025-46296 | 2025-12-16 | An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minimal privileges to access administrative features such as viewing license details and downloading application logs. This vulnerability... |
| CVE-2025-68146 | 2025-12-16 | filelock has TOCTOU race condition that allows symlink attacks during lock file creation |
| CVE-2025-68150 | 2025-12-16 | Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter |
| CVE-2025-68154 | 2025-12-16 | Command Injection in fsSize() on Windows |
| CVE-2025-68155 | 2025-12-16 | @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development |
| CVE-2025-68156 | 2025-12-16 | Expr has Denial of Service via Unbounded Recursion in Builtin Functions |
| CVE-2025-68270 | 2025-12-16 | CourseLimitedStaff Role Allows Studio Access |
| CVE-2025-14553 | 2025-12-16 | Password Hash Leak Could Lead to Unauthorized Access on Tapo 210 via Local Network |
| CVE-2025-8872 | 2025-12-16 | A specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted |
| CVE-2025-13532 | 2025-12-16 | Weak Password Hash in Core Privileged Access Manager (BoKS) |
| CVE-2025-14466 | 2025-12-16 | Güralp Systems Fortimus Series, Minimus Series, and Certimus Series have an Allocation of Resources Without Limits or Throttling vulnerability |
| CVE-2025-48429 | 2025-12-16 | An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to leaking heap data. An attacker can provide a malicious... |
| CVE-2025-52582 | 2025-12-16 | An out-of-bounds read vulnerability exists in the Overlay::GrabOverlayFromPixelData functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious... |
| CVE-2025-53618 | 2025-12-16 | An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious... |
| CVE-2025-53619 | 2025-12-16 | An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious... |
| CVE-2025-64520 | 2025-12-16 | GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API |
| CVE-2025-68274 | 2025-12-16 | SIPGO library has response DoS vulnerability via nil pointer dereference |
| CVE-2025-34288 | 2025-12-16 | Nagios XI Privilege Escalation via Writable PHP Include Executed with Sudo |
| CVE-2025-14765 | 2025-12-16 | Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2025-14766 | 2025-12-16 | Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security... |
| CVE-2022-23851 | 2025-12-17 | Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI). |
| CVE-2024-29370 | 2025-12-17 | In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression... |
| CVE-2024-29371 | 2025-12-17 | In jose4j before 0.9.5, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token... |
| CVE-2024-46060 | 2025-12-17 | Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This... |
| CVE-2024-46062 | 2025-12-17 | Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This... |
| CVE-2025-53398 | 2025-12-17 | The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions, |
| CVE-2025-53919 | 2025-12-17 | An issue was discovered in the Portrait Dell Color Management application through 3.3.008 for Dell monitors, It creates a temporary folder, with weak permissions, during installation and uninstallation. A low-privileged... |
| CVE-2025-65185 | 2025-12-17 | There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then reviewing... |
| CVE-2025-65203 | 2025-12-17 | KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribute sandbox, allowing attacker-controlled script in the sandboxed document to... |
| CVE-2025-65233 | 2025-12-17 | Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by... |
| CVE-2025-65855 | 2025-12-17 | The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across all devices and does not authenticate update servers or validate firmware signatures.... |
| CVE-2025-66921 | 2025-12-17 | A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter. |
| CVE-2025-66923 | 2025-12-17 | A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter. |
| CVE-2025-66924 | 2025-12-17 | A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter. |
| CVE-2025-66953 | 2025-12-17 | CSRF vulnerability in narda miteq Uplink Power Contril Unit UPC2 v.1.17 allows a remote attacker to execute arbitrary code via the Web-based management interface and specifically the /system_setup.htm, /set_clock.htm, /receiver_setup.htm,... |
| CVE-2025-67073 | 2025-12-17 | A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post... |
| CVE-2025-67074 | 2025-12-17 | A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post... |
| CVE-2025-67164 | 2025-12-17 | An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file. |
| CVE-2025-67165 | 2025-12-17 | An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges. |
| CVE-2025-67168 | 2025-12-17 | RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords. |
| CVE-2025-67170 | 2025-12-17 | A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload. |
| CVE-2025-67171 | 2025-12-17 | Incorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to access sensitive files via directory traversal. |
| CVE-2025-67172 | 2025-12-17 | RiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the parse_special_tags() function. |
| CVE-2025-67173 | 2025-12-17 | A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request. |
| CVE-2025-67174 | 2025-12-17 | A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal in the admin_language_file and default_page_language_file in the admin.php... |
| CVE-2025-67285 | 2025-12-17 | A SQL injection vulnerability was found in the '/cts/admin/?page=zone' file of ITSourcecode COVID Tracking System Using QR-Code v1.0. The reason for this issue is that attackers inject malicious code from... |
| CVE-2025-67781 | 2025-12-17 | An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate privileged processes to gain more privileges on Windows computers. |
| CVE-2025-67787 | 2025-12-17 | An issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allows for session takeover over a network. |
| CVE-2025-67789 | 2025-12-17 | An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users can retrieve the computer count of other DriveLock tenants via the DriveLock... |