Vulnerabilities (CVE)

Total 79722 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2025-40581 1 Siemens 2 Scalance Lpe9403, Scalance Lpe9403 Firmware 2025-06-04 N/A 7.1 HIGH
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions with SINEMA Remote Connect Edge Client installed). Affected devices are vulnerable to an authentication bypass. This could allow a non-privileged local attacker to bypass the authentication of the SINEMA Remote Connect Edge Client, and to read and modify the configuration parameters.
CVE-2025-40574 1 Siemens 2 Scalance Lpe9403, Scalance Lpe9403 Firmware 2025-06-04 N/A 7.8 HIGH
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions). Affected devices do not properly assign permissions to critical ressources. This could allow a non-privileged local attacker to interact with the backupmanager service.
CVE-2024-13250 1 Drupal Symfony Mailer Lite Project 1 Drupal Symfony Mailer Lite 2025-06-04 N/A 8.8 HIGH
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.
CVE-2024-13255 1 Restful Web Services Project 1 Restful Web Services 2025-06-04 N/A 7.5 HIGH
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Services: from 7.X-2.0 before 7.X-2.10.
CVE-2024-46330 1 Vonets 2 Vap11g-300, Vap11g-300 Firmware 2025-06-04 N/A 7.4 HIGH
VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the iptablesWebsFilterRun object.
CVE-2024-50305 1 Apache 1 Traffic Server 2025-06-04 N/A 7.5 HIGH
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
CVE-2024-23744 1 Arm 1 Mbed Tls 2025-06-04 N/A 7.5 HIGH
An issue was discovered in Mbed TLS 3.5.1. There is persistent handshake denial if a client sends a TLS 1.3 ClientHello without extensions.
CVE-2024-23681 1 Ls1intum 1 Artemis Java Test Sandbox 2025-06-04 N/A 8.2 HIGH
Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.
CVE-2024-23452 1 Apache 1 Brpc 2025-06-04 N/A 7.5 HIGH
Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description: The http_parser does not comply with the RFC-7230 HTTP 1.1 specification. Attack scenario: If a message is received with both a Transfer-Encoding and a Content-Length header field, such a message might indicate an attempt to perform request smuggling or response splitting. One particular attack scenario is that a bRPC made http server on the backend receiving requests in one persistent connection from frontend server that uses TE to parse request with the logic that 'chunk' is contained in the TE field. in that case an attacker can smuggle a request into the connection to the backend server.  Solution: You can choose one solution from below: 1. Upgrade bRPC to version 1.8.0, which fixes this issue. Download link: https://github.com/apache/brpc/releases/tag/1.8.0 2. Apply this patch:  https://github.com/apache/brpc/pull/2518
CVE-2024-23304 1 Cybozu 1 Kunai 2025-06-04 N/A 7.5 HIGH
Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operations.
CVE-2024-23208 1 Apple 5 Ipados, Iphone Os, Macos and 2 more 2025-06-04 N/A 7.8 HIGH
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may be able to execute arbitrary code with kernel privileges.
CVE-2024-23180 1 Appleple 1 A-blog Cms 2025-06-04 N/A 8.8 HIGH
Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary code by uploading a specially crafted SVG file.
CVE-2022-34707 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-06-04 N/A 7.8 HIGH
Windows Kernel Elevation of Privilege Vulnerability
CVE-2022-34706 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-06-04 N/A 7.8 HIGH
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
CVE-2022-34705 1 Microsoft 5 Windows 10, Windows 11, Windows Server 2016 and 2 more 2025-06-04 N/A 7.8 HIGH
Windows Defender Credential Guard Elevation of Privilege Vulnerability
CVE-2022-34703 1 Microsoft 5 Windows 10, Windows 11, Windows Server 2016 and 2 more 2025-06-04 N/A 7.8 HIGH
Windows Partition Management Driver Elevation of Privilege Vulnerability
CVE-2022-34702 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-06-04 N/A 8.1 HIGH
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2022-34701 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-06-04 N/A 7.5 HIGH
Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability
CVE-2014-1745 1 Google 1 Chrome 2025-06-04 7.5 HIGH 7.1 HIGH
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger removal of an SVGFontFaceElement object, related to core/svg/SVGFontFaceElement.cpp.
CVE-2011-2016 1 Microsoft 3 Windows 7, Windows Server 2008, Windows Vista 2025-06-04 9.3 HIGH 7.3 HIGH
Untrusted search path vulnerability in Windows Mail and Windows Meeting Space in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .eml or .wcinv file, aka "Windows Mail Insecure Library Loading Vulnerability."