Lista CVE - 2025 / Settembre
Visualizzazione 2801 - 2900 di 4322 CVE per Settembre 2025 (Pagina 29 di 44)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2025-10670 | 2025-09-18 | itsourcecode E-Logbook with Health Monitoring System for COVID-19 check_profile.php sql injection |
| CVE-2025-59040 | 2025-09-18 | Tuleap backlog item representations do not verify the permissions of the child trackers |
| CVE-2025-10671 | 2025-09-18 | youth-is-as-pale-as-poetry e-learning JWT Token JwtUtils.java encryptSecret random values |
| CVE-2025-10672 | 2025-09-18 | whuan132 AIBattery com.collweb.AIBatteryHelper BatteryXPCService.swift missing authentication |
| CVE-2025-59417 | 2025-09-18 | Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages |
| CVE-2025-59421 | 2025-09-18 | Press vulnerable to email flooding to users due to lack of validation and rate limits |
| CVE-2025-10673 | 2025-09-18 | itsourcecode Student Information Management System index.php sql injection |
| CVE-2025-36139 | 2025-09-18 | IBM watsonx.data cross-site scripting |
| CVE-2025-36143 | 2025-09-18 | IBM watsonx.data command execution |
| CVE-2025-36146 | 2025-09-18 | IBM watsonx.data information disclosure |
| CVE-2025-10674 | 2025-09-18 | fuyang_lipengjun platform queryAll AttributeCategoryController improper authorization |
| CVE-2025-10675 | 2025-09-18 | fuyang_lipengjun platform queryAll AttributeController improper authorization |
| CVE-2025-10676 | 2025-09-18 | fuyang_lipengjun platform queryAll BrandController improper authorization |
| CVE-2022-50401 | 2025-09-18 | nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure |
| CVE-2022-50402 | 2025-09-18 | drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() |
| CVE-2022-50404 | 2025-09-18 | fbdev: fbcon: release buffer when fbcon_do_set_font() failed |
| CVE-2022-50405 | 2025-09-18 | net/tunnel: wait until all sk_user_data reader finish before releasing the sock |
| CVE-2022-50406 | 2025-09-18 | iomap: iomap: fix memory corruption when recording errors during writeback |
| CVE-2022-50407 | 2025-09-18 | crypto: hisilicon/qm - increase the memory of local variables |
| CVE-2022-50408 | 2025-09-18 | wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() |
| CVE-2022-50409 | 2025-09-18 | net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory |
| CVE-2022-50410 | 2025-09-18 | NFSD: Protect against send buffer overflow in NFSv2 READ |
| CVE-2022-50411 | 2025-09-18 | ACPICA: Fix error code path in acpi_ds_call_control_method() |
| CVE-2022-50412 | 2025-09-18 | drm: bridge: adv7511: unregister cec i2c device after cec adapter |
| CVE-2022-50413 | 2025-09-18 | wifi: mac80211: fix use-after-free |
| CVE-2022-50414 | 2025-09-18 | scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails |
| CVE-2022-50415 | 2025-09-18 | parisc: led: Fix potential null-ptr-deref in start_task() |
| CVE-2022-50416 | 2025-09-18 | irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init() |
| CVE-2022-50417 | 2025-09-18 | drm/panfrost: Fix GEM handle creation ref-counting |
| CVE-2022-50418 | 2025-09-18 | wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register() |
| CVE-2022-50419 | 2025-09-18 | Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times |
| CVE-2023-53419 | 2025-09-18 | rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access |
| CVE-2023-53420 | 2025-09-18 | ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() |
| CVE-2023-53421 | 2025-09-18 | blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() |
| CVE-2023-53422 | 2025-09-18 | wifi: iwlwifi: fw: fix memory leak in debugfs |
| CVE-2023-53423 | 2025-09-18 | objtool: Fix memory leak in create_static_call_sections() |
| CVE-2023-53424 | 2025-09-18 | clk: mediatek: fix of_iomap memory leak |
| CVE-2023-53425 | 2025-09-18 | media: platform: mediatek: vpu: fix NULL ptr dereference |
| CVE-2023-53426 | 2025-09-18 | xsk: Fix xsk_diag use-after-free error during socket cleanup |
| CVE-2023-53427 | 2025-09-18 | cifs: Fix warning and UAF when destroy the MR list |
| CVE-2023-53428 | 2025-09-18 | powercap: arm_scmi: Remove recursion while parsing zones |
| CVE-2023-53429 | 2025-09-18 | btrfs: don't check PageError in __extent_writepage |
| CVE-2023-53430 | 2025-09-18 | wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup |
| CVE-2023-53431 | 2025-09-18 | scsi: ses: Handle enclosure with just a primary component gracefully |
| CVE-2023-53432 | 2025-09-18 | firewire: net: fix use after free in fwnet_finish_incoming_packet() |
| CVE-2023-53433 | 2025-09-18 | net: add vlan_get_protocol_and_depth() helper |
| CVE-2023-53434 | 2025-09-18 | remoteproc: imx_dsp_rproc: Add custom memory copy implementation for i.MX DSP Cores |
| CVE-2023-53435 | 2025-09-18 | cassini: Fix a memory leak in the error handling path of cas_init_one() |
| CVE-2023-53436 | 2025-09-18 | scsi: snic: Fix possible memory leak if device_add() fails |
| CVE-2023-53437 | 2025-09-18 | media: uvcvideo: Handle cameras with invalid descriptors |
| CVE-2023-53438 | 2025-09-18 | x86/MCE: Always save CS register on AMD Zen IF Poison errors |
| CVE-2023-53439 | 2025-09-18 | net: skb_partial_csum_set() fix against transport header magic value |
| CVE-2023-53440 | 2025-09-18 | nilfs2: fix sysfs interface lifetime |
| CVE-2023-53441 | 2025-09-18 | bpf: cpumap: Fix memory leak in cpu_map_update_elem |
| CVE-2023-53442 | 2025-09-18 | ice: Block switchdev mode when ADQ is active and vice versa |
| CVE-2023-53443 | 2025-09-18 | mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak |
| CVE-2023-53444 | 2025-09-18 | drm/ttm: fix bulk_move corruption when adding a entry |
| CVE-2023-53445 | 2025-09-18 | net: qrtr: Fix a refcount bug in qrtr_recvmsg() |
| CVE-2023-53446 | 2025-09-18 | PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free |
| CVE-2023-53447 | 2025-09-18 | f2fs: don't reset unchangable mount option in f2fs_remount() |
| CVE-2025-10687 | 2025-09-18 | SourceCodester Responsive E-Learning System add_teacher.php sql injection |
| CVE-2025-47906 | 2025-09-18 | Unexpected paths returned from LookPath in os/exec |
| CVE-2025-26503 | 2025-09-18 | Buffer manipulation |
| CVE-2025-10650 | 2025-09-18 | Non-admin users may erroneously be granted cluster-level SSH access |
| CVE-2025-10688 | 2025-09-18 | SourceCodester Pet Grooming Management Software paid.php sql injection |
| CVE-2025-59424 | 2025-09-18 | LinkAce Vulnerable to Stored XSS on the Audit Page |
| CVE-2025-10689 | 2025-09-18 | D-Link DIR-645 soap.cgi soapcgi_main command injection |
| CVE-2025-55068 | 2025-09-18 | Dover Fueling Solutions ProGauge MagLink LX4 Devices Integer Overflow or Wraparound |
| CVE-2025-54807 | 2025-09-18 | Dover Fueling Solutions ProGauge MagLink LX4 Devices Use of Hard-coded Cryptographic Key |
| CVE-2025-30519 | 2025-09-18 | Dover Fueling Solutions ProGauge MagLink LX4 Devices Use of Weak Credentials |
| CVE-2025-54754 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware Use of Hard-coded Password |
| CVE-2025-47698 | 2025-09-18 | An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentials are present during the firmware upgrade procedure. |
| CVE-2025-53947 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware Incorrect Default Permissions |
| CVE-2025-54860 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware Improper Restriction of Excessive Authentication Attempts |
| CVE-2025-52873 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware Incorrect Permission Assignment for Critical Resource |
| CVE-2025-54497 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware Incorrect Permission Assignment for Critical Resource |
| CVE-2025-54818 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware Cleartext Transmission of Sensitive Information |
| CVE-2025-59215 | 2025-09-18 | Windows Graphics Component Elevation of Privilege Vulnerability |
| CVE-2025-54810 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware Authentication Bypass by Capture-replay |
| CVE-2025-59216 | 2025-09-18 | Windows Graphics Component Elevation of Privilege Vulnerability |
| CVE-2025-59220 | 2025-09-18 | Windows Bluetooth Service Elevation of Privilege Vulnerability |
| CVE-2025-53969 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware Client-Side Enforcement of Server-Side Security |
| CVE-2025-10035 | 2025-09-18 | Deserialization Vulnerability in GoAnywhere MFT's License Servlet |
| CVE-2025-30755 | 2025-09-18 | OpenGrok 1.14.1 has a reflected Cross-Site Scripting (XSS) issue when producing the cross reference page. This happens through improper handling of the revision parameter. The application reflects unsanitized user input... |
| CVE-2025-48703 | 2025-09-19 | CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid... |
| CVE-2025-52159 | 2025-09-19 | Hardcoded credentials in default configuration of PPress 0.0.9. |
| CVE-2025-54761 | 2025-09-19 | An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie. |
| CVE-2025-54815 | 2025-09-19 | Server-side template injection (SSTI) vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes. |
| CVE-2025-55910 | 2025-09-19 | CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php. |
| CVE-2025-56762 | 2025-09-19 | Paracrawl KeOPs v2 is vulnerable to Cross Site Scripting (XSS) in error.php. |
| CVE-2025-56869 | 2025-09-19 | Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in backend/src/applications/files/services/files-manager.service.ts, and FilesManager.compress function in... |
| CVE-2025-57296 | 2025-09-19 | Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the... |
| CVE-2025-57396 | 2025-09-19 | Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User Profile API Endpoint containing two... |
| CVE-2025-57528 | 2025-09-19 | An issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara2 parameters to the formSetCfm function (uri path: SetCfm). |
| CVE-2025-57644 | 2025-09-19 | Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbitrary Java code on the server, resulting in remote code execution. In... |
| CVE-2025-59689 | 2025-09-19 | Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix... |
| CVE-2025-59712 | 2025-09-19 | Snipe-IT before 8.1.18 allows XSS. |
| CVE-2025-59713 | 2025-09-19 | Snipe-IT before 8.1.18 allows unsafe deserialization. |
| CVE-2025-59714 | 2025-09-19 | In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs. |
| CVE-2025-59715 | 2025-09-19 | SMSEagle before 6.11 allows reflected XSS via a username or contact phone number. |