Lista CVE - 2025 / Dicembre
Visualizzazione 1701 - 1800 di 3706 CVE per Dicembre 2025 (Pagina 18 di 38)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2021-47731 | 2025-12-09 | Selea Targa IP Camera Developer Backdoor Configuration Overwrite |
| CVE-2023-53739 | 2025-12-09 | Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure |
| CVE-2023-53770 | 2025-12-09 | MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint |
| CVE-2025-67489 | 2025-12-09 | @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server |
| CVE-2023-53771 | 2025-12-09 | MiniDVBLinux 5.4 Unauthenticated Root Password Change via System Setup |
| CVE-2023-53772 | 2025-12-09 | MiniDVBLinux 5.4 Arbitrary File Read Vulnerability via About Page |
| CVE-2023-53773 | 2025-12-09 | MiniDVBLinux 5.4 Unauthenticated Live Stream Disclosure via tv_action.sh |
| CVE-2023-53774 | 2025-12-09 | MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol Remote Code Execution |
| CVE-2025-34425 | 2025-12-09 | MailEnable < 10.54 Reflected XSS in WindowContext Parameter of MAI/compose.aspx |
| CVE-2025-66039 | 2025-12-09 | FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header |
| CVE-2025-66645 | 2025-12-09 | NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading |
| CVE-2025-36437 | 2025-12-09 | IBM Planning Analytics Local is vulnerable to disclosing sensitive information |
| CVE-2025-67494 | 2025-12-09 | ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login |
| CVE-2025-67495 | 2025-12-09 | ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login |
| CVE-2025-67496 | 2025-12-09 | WeGia is Vulnerable to XSS through id_pessoa Parameter on Password Configuration Page |
| CVE-2025-67499 | 2025-12-09 | CNI Plugins Portmap nftables backend intercepts non-local traffic |
| CVE-2025-61811 | 2025-12-09 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) |
| CVE-2025-61823 | 2025-12-09 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) |
| CVE-2025-64897 | 2025-12-09 | ColdFusion | Improper Access Control (CWE-284) |
| CVE-2025-61822 | 2025-12-09 | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2025-61809 | 2025-12-09 | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2025-61810 | 2025-12-09 | ColdFusion | Deserialization of Untrusted Data (CWE-502) |
| CVE-2025-64898 | 2025-12-09 | ColdFusion | Insufficiently Protected Credentials (CWE-522) |
| CVE-2025-61821 | 2025-12-09 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) |
| CVE-2025-61812 | 2025-12-09 | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2025-61813 | 2025-12-09 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) |
| CVE-2025-61808 | 2025-12-09 | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) |
| CVE-2025-67500 | 2025-12-09 | Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration |
| CVE-2025-67501 | 2025-12-09 | WeGIA is vulnerable to SQL Injection via editar_categoria endpoint parameter |
| CVE-2025-67502 | 2025-12-09 | Taguette does not safeguard against Open Redirect |
| CVE-2025-24857 | 2025-12-10 | Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an... |
| CVE-2025-52493 | 2025-12-10 | PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets appear masked as password fields, the actual secret values are present... |
| CVE-2025-56429 | 2025-12-10 | Cross Site Scripting vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to obtain sensitive information via the login.php component. |
| CVE-2025-56430 | 2025-12-10 | Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.php and the deleteDirectory function. |
| CVE-2025-56431 | 2025-12-10 | Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.php and the file_get_contents() function. |
| CVE-2025-63094 | 2025-12-10 | XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing attackers to access sensitive information via side-channel analysis of the data cache. |
| CVE-2025-63895 | 2025-12-10 | An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted... |
| CVE-2025-65290 | 2025-12-10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downloads, allowing man-in-the-middle attackers to intercept firmware... |
| CVE-2025-65291 | 2025-12-10 | Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling... |
| CVE-2025-65292 | 2025-12-10 | Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands with root privileges through malicious... |
| CVE-2025-65293 | 2025-12-10 | Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR codes during device setup and factory reset. |
| CVE-2025-65294 | 2025-12-10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution. |
| CVE-2025-65295 | 2025-12-10 | Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper... |
| CVE-2025-65296 | 2025-12-10 | NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing enable denial-of-service attacks through malformed JSON inputs. |
| CVE-2025-65297 | 2025-12-10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent... |
| CVE-2025-65512 | 2025-12-10 | A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before. This vulnerability allows an attacker to bypass private IP restrictions through hostname-based... |
| CVE-2025-65602 | 2025-12-10 | A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request. |
| CVE-2025-65754 | 2025-12-10 | Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filename. |
| CVE-2025-65792 | 2025-12-10 | DataGear v5.5.0 is vulnerable to Arbitrary File Deletion. |
| CVE-2025-65803 | 2025-12-10 | An integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted PSD file. |
| CVE-2025-65807 | 2025-12-10 | An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command. |
| CVE-2025-65814 | 2025-12-10 | A lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word v6.4.1 allows attackers to execute a directory traversal. |
| CVE-2025-65815 | 2025-12-10 | A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC, PPT v65.0 allows attackers to execute a directory traversal. |
| CVE-2025-65820 | 2025-12-10 | An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not... |
| CVE-2025-65821 | 2025-12-10 | As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and retrieve sensitive information such... |
| CVE-2025-65822 | 2025-12-10 | The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a commercial product an... |
| CVE-2025-65823 | 2025-12-10 | The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on. If an attacker retrieved this, and found... |
| CVE-2025-65824 | 2025-12-10 | An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy (BLE), resulting in the firmware on the... |
| CVE-2025-65825 | 2025-12-10 | The firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical access to the Meatmeet device can disassemble the device, connect over UART, and retrieve the... |
| CVE-2025-65826 | 2025-12-10 | The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found the physical location of the Wi-Fi network,... |
| CVE-2025-65827 | 2025-12-10 | The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept... |
| CVE-2025-65828 | 2025-12-10 | An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these devices which would result in a Denial of Service. These... |
| CVE-2025-65829 | 2025-12-10 | The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures that only authenticated software can execute... |
| CVE-2025-65830 | 2025-12-10 | Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt the TLS traffic, inspect its... |
| CVE-2025-65831 | 2025-12-10 | The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through exploiting cloud services, performing TLS downgrade attacks on... |
| CVE-2025-65832 | 2025-12-10 | The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has logged out and terminated it, Wi-Fi credentials sent during... |
| CVE-2025-67485 | 2025-12-10 | HTTP/HTTPS Traffic Interception Bypass in mad-proxy |
| CVE-2025-67506 | 2025-12-10 | PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload |
| CVE-2025-67507 | 2025-12-10 | Filament's multi-factor authentication (app) recovery codes can be used multiple times |
| CVE-2025-13613 | 2025-12-10 | Elated Membership <= 1.2 - Authentication Bypass via Social Login |
| CVE-2025-13677 | 2025-12-10 | Simple Download Counter <= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal |
| CVE-2025-9056 | 2025-12-10 | Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation. |
| CVE-2025-13339 | 2025-12-10 | Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read |
| CVE-2025-13072 | 2025-12-10 | HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via utm_source |
| CVE-2025-13073 | 2025-12-10 | HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via handl_landing_page |
| CVE-2025-9571 | 2025-12-10 | Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload |
| CVE-2025-12952 | 2025-12-10 | Privilege Escalation in Dialogflow CX via Webhook Admin Role |
| CVE-2025-13954 | 2025-12-10 | Hard-coded cryptographic keys in EZCast Pro II Dongle |
| CVE-2025-13955 | 2025-12-10 | Predictable Default Wi-Fi Password in EZCast Pro II Dongle |
| CVE-2025-9315 | 2025-12-10 | Unauthenticated Device Registration Vulnerability in MXsecurity Series |
| CVE-2025-14087 | 2025-12-10 | Glib: glib: buffer underflow in gvariant parser leads to heap corruption |
| CVE-2025-1161 | 2025-12-10 | Improper Authorization in Nomysoft Informatics' Nomysem |
| CVE-2025-14082 | 2025-12-10 | Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure |
| CVE-2025-66004 | 2025-12-10 | Local privilege escalation in usbmuxd from arbitrary local user to usbmux |
| CVE-2025-14390 | 2025-12-10 | Video Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload |
| CVE-2025-66675 | 2025-12-10 | Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed |
| CVE-2025-7073 | 2025-12-10 | Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security |
| CVE-2025-41730 | 2025-12-10 | Stack-based buffer overflow via unsafe sscanf in check_account() |
| CVE-2025-41732 | 2025-12-10 | Stack-based buffer overflow via unsafe sscanf in check_cookie() |
| CVE-2025-41358 | 2025-12-10 | Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A |
| CVE-2025-13953 | 2025-12-10 | Bypass in the authentication method of the GTT Sistema de Información Tributario application |
| CVE-2025-13184 | 2025-12-10 | Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password |
| CVE-2024-2104 | 2025-12-10 | JBL: Improper BLE security configurations and lack of authentication on the device's GATT server |
| CVE-2024-2105 | 2025-12-10 | JBL: Improper validation of ICM field in connection requests |
| CVE-2025-8110 | 2025-12-10 | File overwrite in file update API in Gogs |
| CVE-2025-13127 | 2025-12-10 | XSS in TACAS Consulting's GoldenHorn |
| CVE-2025-12046 | 2025-12-10 | A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code with elevated privileges under certain... |
| CVE-2025-13152 | 2025-12-10 | A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local authenticated user to execute code with elevated privileges. |
| CVE-2025-13155 | 2025-12-10 | An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with elevated privileges. |
| CVE-2025-13125 | 2025-12-10 | IDOR in Im Park's DijiDemi |