Thu, Oct 02 · 02:15 PM CDTCVE-2025-59735
9.8/10 · Must read/watchNVDvuln
Summary
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM.ASP'.
CVECVE-2025-59735
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 02 · 02:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-59736
9.8/10 · Must read/watchNVDvuln
Summary
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_DJO.ASP'.
CVECVE-2025-59736
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 02 · 02:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-59737
9.8/10 · Must read/watchNVDvuln
Summary
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_LXA.ASP'.
CVECVE-2025-59737
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 02 · 02:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-59738
9.8/10 · Must read/watchNVDvuln
Summary
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_BET.ASP'.
CVECVE-2025-59738
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 02 · 02:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-59739
9.8/10 · Must read/watchNVDvuln
Summary
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_original.ASP'.
CVECVE-2025-59739
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 02 · 02:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-59740
9.8/10 · Must read/watchNVDvuln
Summary
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_CAT.ASP'.
CVECVE-2025-59740
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 02 · 02:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-59741
9.8/10 · Must read/watchNVDvuln
Summary
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/CLT/LOGINERRORFRM.ASP'.
CVECVE-2025-59741
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 02 · 03:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-59742
9.8/10 · Must read/watchNVDvuln
Summary
SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'USRMAIL' parameter in'/inc/login/TRACK_REQUESTFRMSQL.ASP'.
CVECVE-2025-59742
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 02 · 03:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-59743
9.8/10 · Must read/watchNVDvuln
Summary
SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'SessionID' cookie in '/inc/connect/CONNECTION.ASP'.
CVECVE-2025-59743
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 02 · 03:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-8679
9.8/10 · Must read/watchNVDvuln
Summary
In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access.
CVECVE-2025-8679
SeverityCRITICAL
TypeUPDATED
PublishedWed, Oct 01 · 06:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-49794
9.1/10 · Must read/watchNVDvuln
Summary
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or
CVECVE-2025-49794
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jun 16 · 04:15 PM CDT
ModifiedMon, Oct 12 · 08:17 PM CDT
CVE-2025-59951
9.1/10 · Must read/watchNVDvuln
Summary
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1.5.0 and below, due to being configured with an Nginx reverse proxy, causes the backend to retrieve the proxy's IP instead of the client's IP when using the req.ip
CVECVE-2025-59951
SeverityCRITICAL
TypeUPDATED
PublishedWed, Oct 01 · 10:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-11020
8.8/10 · Worth your timeNVDvuln
Summary
An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with Dangerous Type vulnerability in MarkAny SafePC Enterprise on Windows, Linux.This issue affects SafePC Enterprise: V7.0.* (V7.0.YYYY.MM.DD) before V7.0.1, and V5
CVECVE-2025-11020
SeverityHIGH
TypeUPDATED
PublishedThu, Oct 02 · 06:15 AM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-11221
8.8/10 · Worth your timeNVDvuln
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type vulnerability in GTONE ChangeFlow allows Path Traversal, Accessing Functionality Not Properly Constrained by ACLs.This issue affects ChangeFlow: from All versions through v9.0.1.1.
CVECVE-2025-11221
SeverityHIGH
TypeUPDATED
PublishedThu, Oct 02 · 06:15 AM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-54286
8.8/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.
CVECVE-2025-54286
SeverityHIGH
TypeUPDATED
PublishedThu, Oct 02 · 10:15 AM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2024-11218
8.6/10 · Worth your timeNVDvuln
Summary
A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.
CVECVE-2024-11218
SeverityHIGH
TypeUPDATED
PublishedWed, Jan 22 · 05:15 AM CST
ModifiedTue, Oct 13 · 03:16 AM CDT
CVE-2024-33396
8.4/10 · Worth your timeNVDvuln
Summary
An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: Then maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.
CVECVE-2024-33396
SeverityHIGH
TypeUPDATED
PublishedThu, May 02 · 07:15 PM CDT
ModifiedMon, Oct 12 · 09:17 PM CDT
CVE-2024-3727
8.3/10 · Worth your timeNVDvuln
Summary
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
CVECVE-2024-3727
SeverityHIGH
TypeUPDATED
PublishedTue, May 14 · 03:42 PM CDT
ModifiedTue, Oct 13 · 03:16 AM CDT
CVE-2025-6032
8.3/10 · Worth your timeNVDvuln
Summary
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
CVECVE-2025-6032
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 24 · 02:15 PM CDT
ModifiedMon, Oct 12 · 08:17 PM CDT
CVE-2024-54678
8.2/10 · Worth your timeNVDvuln
Summary
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 9), SIMATIC STEP 7 V18 (All versions < V18 Update 6), SIMATIC STEP
CVECVE-2024-54678
SeverityHIGH
TypeUPDATED
PublishedTue, Aug 12 · 12:15 PM CDT
ModifiedTue, Oct 13 · 10:17 AM CDT
CVE-2025-54289
8.1/10 · Worth your timeNVDvuln
Summary
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
CVECVE-2025-54289
SeverityHIGH
TypeUPDATED
PublishedThu, Oct 02 · 10:15 AM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2024-49849
7.8/10 · Worth your timeNVDvuln
Summary
A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 9), SIMATIC STEP 7 Safety V18 (All versions < V18 Update 6), SIMATIC STEP 7 Safety V19 (All versions < V19 Upd
CVECVE-2024-49849
SeverityHIGH
TypeUPDATED
PublishedTue, Dec 10 · 02:30 PM CST
ModifiedTue, Oct 13 · 10:17 AM CDT
CVE-2025-10578
7.8/10 · Worth your timeNVDvuln
Summary
A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.
CVECVE-2025-10578
SeverityHIGH
TypeUPDATED
PublishedWed, Oct 01 · 07:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-23297
7.8/10 · Worth your timeNVDvuln
Summary
NVIDIA Installer for NvAPP for Windows contains a vulnerability in the FrameviewSDK installation process, where an attacker with local unprivileged access could modify files in the Frameview SDK directory. A successful exploit of this vulnerability might lead to escalation of privileges.
CVECVE-2025-23297
SeverityHIGH
TypeUPDATED
PublishedWed, Oct 01 · 10:15 PM CDT
ModifiedMon, Oct 12 · 03:10 PM CDT
CVE-2025-30033
7.8/10 · Worth your timeNVDvuln
Summary
The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component.
CVECVE-2025-30033
SeverityHIGH
TypeUPDATED
PublishedTue, Aug 12 · 12:15 PM CDT
ModifiedTue, Oct 13 · 10:17 AM CDT
