CyberAlerts

CVE-2025-1399

Description: Out-of-bounds Read vulnerability in unpack_response (session.c) in libplctag from 2.0 through 2.6.3 allows Overread Buffers via network.

CVSS: LOW (3.1)

EPSS Score: 0.03%

Source: CVE

May 7th, 2025 (about 1 month ago)

CVE-2025-46735

Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`

Description: Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Terraform WinDNS Provider before version `1.0.5`. The `windns_record` resource did not sanitize the input variables. This could lead to authenticated command injection in the underlyding powershell command prompt. Version 1.0.5 contains a fix for the issue.

CVSS: LOW (1.1)

EPSS Score: 0.19%

Source: CVE

May 6th, 2025 (about 1 month ago)

CVE-2025-23379

Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation...

Description: Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.

CVSS: LOW (3.5)

EPSS Score: 0.04%

SSVC Exploitation: none

Source: CVE

May 6th, 2025 (about 1 month ago)

CVE-2025-22479

Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path...

Description: Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.

CVSS: LOW (3.5)

EPSS Score: 0.02%

Source: CVE

May 6th, 2025 (about 1 month ago)

CVE-2025-46814

FastAPI Guard Remote Header Injection via X-Forwarded-For Manipulation

Description: FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. An HTTP header injection vulnerability has been identified in versions prior to 2.0.0. By manipulating the X-Forwarded-For header, an attacker can potentially inject arbitrary IP addresses into the request. This vulnerability can allow attackers to bypass IP-based access controls, mislead logging systems, and impersonate trusted clients. It is especially impactful when the application relies on the X-Forwarded-For header for IP-based authorization or authentication. Users should upgrade to FastAPI Guard version 2.0.0 to receive a fix.

CVSS: LOW (3.4)

EPSS Score: 0.08%

Source: CVE

May 6th, 2025 (about 1 month ago)

CVE-2025-27248

ai_neural_network_runtime has a NULL pointer dereference vulnerability

Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.

CVSS: LOW (3.3)

EPSS Score: 0.01%

Source: CVE

May 6th, 2025 (about 1 month ago)

CVE-2025-27241

multimedia_av_codec has a NULL pointer dereference vulnerability

Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.

CVSS: LOW (3.3)

EPSS Score: 0.01%

Source: CVE

May 6th, 2025 (about 1 month ago)

CVE-2025-27132

arkcompiler_ets_runtime has an out-of-bounds write vulnerability

Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.

CVSS: LOW (3.8)

EPSS Score: 0.02%

Source: CVE

May 6th, 2025 (about 1 month ago)

CVE-2025-25052

arkcompiler_ets_runtime has a buffer overflow vulnerability

Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through buffer overflow.

CVSS: LOW (3.3)

EPSS Score: 0.01%

Source: CVE

May 6th, 2025 (about 1 month ago)

CVE-2025-22886

distributeddatamgr_udmf has a memory leak vulnerability

Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.

CVSS: LOW (3.3)

EPSS Score: 0.01%

Source: CVE

May 6th, 2025 (about 1 month ago)

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2025-1399	Out-of-bounds Read in libplctag library Description: Out-of-bounds Read vulnerability in unpack_response (session.c) in libplctag from 2.0 through 2.6.3 allows Overread Buffers via network. CVSS: LOW (3.1) EPSS Score: 0.03% Source: CVE May 7th, 2025 (about 1 month ago)
CVE-2025-46735	Terraform WinDNS Provider improperly sanitizes input variables in `windns_record` Description: Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Terraform WinDNS Provider before version `1.0.5`. The `windns_record` resource did not sanitize the input variables. This could lead to authenticated command injection in the underlyding powershell command prompt. Version 1.0.5 contains a fix for the issue. CVSS: LOW (1.1) EPSS Score: 0.19% Source: CVE May 6th, 2025 (about 1 month ago)
CVE-2025-23379	Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation... Description: Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection. CVSS: LOW (3.5) EPSS Score: 0.04% SSVC Exploitation: none Source: CVE May 6th, 2025 (about 1 month ago)
CVE-2025-22479	Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path... Description: Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection. CVSS: LOW (3.5) EPSS Score: 0.02% Source: CVE May 6th, 2025 (about 1 month ago)
CVE-2025-46814	FastAPI Guard Remote Header Injection via X-Forwarded-For Manipulation Description: FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. An HTTP header injection vulnerability has been identified in versions prior to 2.0.0. By manipulating the X-Forwarded-For header, an attacker can potentially inject arbitrary IP addresses into the request. This vulnerability can allow attackers to bypass IP-based access controls, mislead logging systems, and impersonate trusted clients. It is especially impactful when the application relies on the X-Forwarded-For header for IP-based authorization or authentication. Users should upgrade to FastAPI Guard version 2.0.0 to receive a fix. CVSS: LOW (3.4) EPSS Score: 0.08% Source: CVE May 6th, 2025 (about 1 month ago)
CVE-2025-27248	ai_neural_network_runtime has a NULL pointer dereference vulnerability Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. CVSS: LOW (3.3) EPSS Score: 0.01% Source: CVE May 6th, 2025 (about 1 month ago)
CVE-2025-27241	multimedia_av_codec has a NULL pointer dereference vulnerability Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. CVSS: LOW (3.3) EPSS Score: 0.01% Source: CVE May 6th, 2025 (about 1 month ago)
CVE-2025-27132	arkcompiler_ets_runtime has an out-of-bounds write vulnerability Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios. CVSS: LOW (3.8) EPSS Score: 0.02% Source: CVE May 6th, 2025 (about 1 month ago)
CVE-2025-25052	arkcompiler_ets_runtime has a buffer overflow vulnerability Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through buffer overflow. CVSS: LOW (3.3) EPSS Score: 0.01% Source: CVE May 6th, 2025 (about 1 month ago)
CVE-2025-22886	distributeddatamgr_udmf has a memory leak vulnerability Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory. CVSS: LOW (3.3) EPSS Score: 0.01% Source: CVE May 6th, 2025 (about 1 month ago)