Total
373 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-30201 | 1 Wazuh | 1 Wazuh | 2025-12-02 | N/A | 7.7 HIGH |
| Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings, potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0. | |||||
| CVE-2025-20614 | 1 Intel | 1 Computing Improvement Program | 2025-11-26 | N/A | 6.7 MEDIUM |
| External control of file name or path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. | |||||
| CVE-2025-59511 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2025-11-17 | N/A | 7.8 HIGH |
| External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2025-59185 | 1 Microsoft | 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more | 2025-11-05 | N/A | 6.5 MEDIUM |
| External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network. | |||||
| CVE-2020-36868 | 1 Nagios | 1 Nagios Xi | 2025-11-05 | N/A | 7.8 HIGH |
| Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and initialization routines using insecure file/command handling and insufficient validation of attacker-controlled inputs, and in some deployments executed with elevated privileges. A local attacker with low-level access could exploit these weaknesses to cause the script to execute arbitrary commands or modify privileged files, resulting in privilege escalation. | |||||
| CVE-2024-22178 | 1 Openautomationsoftware | 1 Open Automation Software | 2025-11-04 | N/A | 4.9 MEDIUM |
| A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequence of requests to trigger this vulnerability. | |||||
| CVE-2024-21870 | 1 Openautomationsoftware | 1 Open Automation Software | 2025-11-04 | N/A | 4.9 MEDIUM |
| A file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequence of requests to trigger this vulnerability. | |||||
| CVE-2025-0111 | 1 Paloaltonetworks | 1 Pan-os | 2025-11-04 | N/A | 6.5 MEDIUM |
| An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software. | |||||
| CVE-2025-8050 | 1 Opentext | 1 Flipper | 2025-10-28 | N/A | 6.5 MEDIUM |
| External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to access files hosted on the server. This issue affects Flipper: 3.1.2. | |||||
| CVE-2025-8048 | 1 Opentext | 1 Flipper | 2025-10-28 | N/A | 6.5 MEDIUM |
| External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to submit a stored local file path and then download the specified file from the system by requesting the stored document ID. This issue affects Flipper: 3.1.2. | |||||
| CVE-2024-43451 | 1 Microsoft | 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more | 2025-10-28 | N/A | 6.5 MEDIUM |
| NTLM Hash Disclosure Spoofing Vulnerability | |||||
| CVE-2025-33053 | 1 Microsoft | 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more | 2025-10-27 | N/A | 8.8 HIGH |
| External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2025-35053 | 1 Newforma | 1 Project Center | 2025-10-22 | N/A | 6.4 MEDIUM |
| Newforma Info Exchange (NIX) accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'DownloadExportedPDF' command that allow an authenticated user to read and delete arbitrary files with 'NT AUTHORITY\NetworkService' privileges. In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as 'anonymous' and exploit this file upload vulnerability. | |||||
| CVE-2025-59483 | 1 F5 | 21 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Advanced Web Application Firewall and 18 more | 2025-10-21 | N/A | 6.5 MEDIUM |
| A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2025-59291 | 1 Microsoft | 1 Azure Compute Gallery | 2025-10-17 | N/A | 8.2 HIGH |
| External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2025-59292 | 1 Microsoft | 1 Azure Compute Gallery | 2025-10-17 | N/A | 8.2 HIGH |
| External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2025-59200 | 1 Microsoft | 14 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 11 more | 2025-10-17 | N/A | 7.7 HIGH |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Data Sharing Service Client allows an unauthorized attacker to perform spoofing locally. | |||||
| CVE-2025-59244 | 1 Microsoft | 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more | 2025-10-17 | N/A | 6.5 MEDIUM |
| External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network. | |||||
| CVE-2025-0124 | 1 Paloaltonetworks | 1 Pan-os | 2025-10-02 | N/A | 3.8 LOW |
| An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue affects Cloud NGFW. However, this issue does not affect Prisma® Access software. | |||||
| CVE-2024-11838 | 1 Plextrac | 1 Plextrac | 2025-10-01 | N/A | 9.8 CRITICAL |
| External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | |||||