CVE Vulnerability Advisory Database

[Affected Scope] MikroTik RouterOS versions 6.x and 7.x prior to specific patched releases.

[Impact] Unauthenticated attackers can exploit the bandwidth test (btest) feature to leak kernel memory or cause a Denial of Service (DoS) via kernel restart.

[Mitigation] Apply security patches (6.49.21, 7.23.4, 7.24.2 or later) and disable the bandwidth test server.

[Affected Scope] Network devices and virtual appliances running Cisco Catalyst SD-WAN Software

[Impact] Attackers can bypass file system restrictions via vshell access to read sensitive underlying operating system information

[Mitigation] Apply the official Cisco security patches immediately and restrict vshell/CLI access privileges

[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Desktop Windows Manager (DWM) component

[Impact] An authorized local attacker can disclose sensitive information from kernel or process memory, potentially facilitating subsequent privilege escalation

[Mitigation] Immediately apply the latest Microsoft cumulative security updates and restrict unauthorized local access on unpatched systems

[Affected Scope] All Wing FTP Server installations running versions prior to 7.4.4

[Impact] Attackers can disclose the full local installation path of the application by supplying an excessively long value in the UID cookie, facilitating subsequent targeted attacks

[Mitigation] Immediately upgrade Wing FTP Server to version 7.4.4 or later, and deploy WAF rules to restrict anomalous cookie lengths in the interim

[Affected Scope] TeleMessage service deployments through 2025-05-05

[Impact] Unauthenticated remote attackers can download the JVM heap dump via the exposed /heapdump endpoint, leading to the extraction of sensitive credentials, API keys, and user data from memory

[Mitigation] Disable the heapdump Actuator endpoint immediately, restrict external access via reverse proxies/WAFs, and rotate all potentially compromised credentials

[Affected Scope] Projects running Vite development server exposed to the network (via --host or server.host configuration) using versions prior to 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11

[Impact] Remote attackers can bypass access restrictions and retrieve sensitive source code or system files by appending crafted query parameters (?inline&import or ?raw?import) to requests

[Mitigation] Immediately upgrade Vite to the patched versions (6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11) and disable unnecessary external host binding (--host)

[Affected Scope] All Windows operating system deployments utilizing the NTFS file system

[Impact] An unauthorized attacker with physical access can extract sensitive information written in plaintext within NTFS system log files

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and enforce BitLocker Full Disk Encryption (FDE)

[Affected Scope] VMware ESXi, Workstation, and Fusion environments utilizing the Host-Guest File System (HGFS) for file sharing.

[Impact] A malicious actor with local administrative privileges on a guest VM can read out-of-bounds memory from the host's vmx process, potentially bypassing ASLR to facilitate hypervisor escape.

[Mitigation] Apply the official security patches provided by Broadcom, or disable the HGFS (Shared Folders) feature in the virtual machine configuration as a temporary workaround.

[Affected Scope] Ivanti EPM versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update

[Impact] Remote unauthenticated attackers can exploit absolute path traversal to leak highly sensitive system information

[Mitigation] Immediately apply the official Ivanti security updates and restrict access to the EPM management interfaces

[Affected Scope] Ivanti EPM 2024 prior to the January 2025 Security Update, and EPM 2022 SU6 prior to the January 2025 Security Update

[Impact] A remote unauthenticated attacker can exploit an absolute path traversal vulnerability to leak highly sensitive system information and credentials

[Mitigation] Immediately apply the official Ivanti January 2025 Security Update and restrict access to the EPM management console

[Affected Scope] All Linux kernel-based systems utilizing HID (Human Interface Device) drivers

[Impact] Local attackers can exploit uninitialized memory buffers to leak sensitive kernel memory contents via specially-crafted HID reports

[Mitigation] Apply the latest stable kernel updates provided by your Linux distribution and reboot the system

[Affected Scope] Oracle Supply Chain - Oracle Agile PLM Framework version 9.3.6 (Software Development Kit, Process Extension component)

[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to gain unauthorized access to critical data or complete access to all accessible data within the framework

[Mitigation] Immediately apply the official security patches provided by Oracle and restrict external HTTP/HTTPS access to the affected system

[Affected Scope] PTZOptics PT30X-SDI and PT30X-NDI camera devices running firmware versions prior to 6.3.40.

[Impact] Remote, unauthenticated attackers can bypass authentication by omitting the HTTP Authorization header, leading to the exposure of sensitive configuration data, password hashes, and unauthorized configuration modifications.

[Mitigation] Immediately upgrade the camera firmware to version 6.3.40 or higher and restrict external internet access to the device.

[Affected Scope] Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0.

[Impact] Unauthenticated remote attackers can exploit this vulnerability via T3 or IIOP protocols to gain unauthorized access to critical data or compromise all accessible data.

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict/disable T3 and IIOP protocols if they are not required.

[Affected Scope] Twilio Authy API endpoints accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0

[Impact] Unauthenticated attackers can verify whether specific phone numbers are registered with Authy, enabling large-scale enumeration and targeted phishing/social engineering attacks

[Mitigation] Immediately update mobile applications to the latest versions (Android 25.1.0+ / iOS 26.1.0+) and enforce strict rate limiting on API gateways

[Affected Scope] TP-Link TL-WR841N wireless routers

[Impact] Network-adjacent attackers can bypass authentication to access the httpd service (TCP port 80) and disclose stored credentials, leading to full device compromise

[Mitigation] Apply the latest official firmware updates from the vendor and disable remote management features immediately

[Affected Scope] Google Pixel devices and Android operating system

[Impact] Local attackers can disclose sensitive system memory information without requiring additional execution privileges or user interaction

[Mitigation] Immediately apply the April 2024 Google Pixel security update and upgrade to the latest firmware version

[Affected Scope] Systems running affected versions of Microsoft .NET Framework and .NET Core, particularly within IIS or web application server environments.

[Impact] Unauthenticated remote attackers can trigger specific exceptions to obtain sensitive debugging information, including internal system paths and memory states.

[Mitigation] Apply the official Microsoft cumulative security updates immediately and disable detailed error messages in the web.config configuration.

[Affected Scope] ownCloud graphapi app versions 0.2.0 to 0.2.0, and 0.3.0 to 0.3.0 (both containerized and non-containerized environments)

[Impact] Unauthenticated attackers can access a specific URL to execute phpinfo(), exposing sensitive environment variables including admin passwords, mail server credentials, and license keys

[Mitigation] Immediately upgrade the graphapi app to version 0.2.1 or 0.3.1 (or higher), and rotate all potentially exposed credentials

[Affected Scope] Microsoft WordPad application on Windows operating systems

[Impact] Attackers can force the system to leak NTLM credentials (hashes) by inducing users to open a specially crafted document, enabling offline brute-force or NTLM relay attacks

[Mitigation] Apply the official Microsoft cumulative security updates, block outbound NTLM traffic, and restrict outbound SMB connections