CyberAlerts

CVE-2025-5901

TOTOLINK T10 POST Request cstecgi.cgi UploadCustomModule buffer overflow

Description: A vulnerability has been found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument File leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. In TOTOLINK T10 4.1.8cu.5207 wurde eine kritische Schwachstelle gefunden. Hierbei betrifft es die Funktion UploadCustomModule der Datei /cgi-bin/cstecgi.cgi der Komponente POST Request Handler. Dank der Manipulation des Arguments File mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung.

CVSS: HIGH (8.7)

EPSS Score: 0.08%

Source: CVE

June 9th, 2025 (4 days ago)

CVE-2025-5900

Tenda AC9 cross-site request forgery

Description: A vulnerability, which was classified as problematic, was found in Tenda AC9 15.03.02.13. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Es wurde eine problematische Schwachstelle in Tenda AC9 15.03.02.13 gefunden. Dabei betrifft es einen unbekannter Codeteil. Durch Beeinflussen mit unbekannten Daten kann eine cross-site request forgery-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.

CVSS: MEDIUM (5.3)

EPSS Score: 0.02%

Source: CVE

June 9th, 2025 (4 days ago)

CVE-2025-5899

GNU PSPP pspp-convert.c parse_variables_option free of memory not on the heap

Description: A vulnerability classified as critical was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected by this vulnerability is the function parse_variables_option of the file utilities/pspp-convert.c. The manipulation leads to free of memory not on the heap. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. In GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb wurde eine kritische Schwachstelle entdeckt. Das betrifft die Funktion parse_variables_option der Datei utilities/pspp-convert.c. Durch Manipulieren mit unbekannten Daten kann eine free of memory not on the heap-Schwachstelle ausgenutzt werden. Der Angriff muss lokal angegangen werden. Der Exploit steht zur öffentlichen Verfügung.

CVSS: MEDIUM (5.3)

EPSS Score: 0.01%

Source: CVE

June 9th, 2025 (4 days ago)

CVE-2025-30515

CyberData 011209 SIP Emergency Intercom Path Traversal

Description: CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.

CVSS: CRITICAL (9.8)

EPSS Score: 0.06%

Source: CVE

June 9th, 2025 (4 days ago)

CVE-2025-30507

CyberData 011209 SIP Emergency Intercom SQL Injection

Description: CyberData 011209 Intercom could allow an unauthenticated user to gather sensitive information through blind SQL injections.

CVSS: MEDIUM (5.3)

EPSS Score: 0.04%

Source: CVE

June 9th, 2025 (4 days ago)

CVE-2025-30184

CyberData 011209 SIP Emergency Intercom Authentication Bypass Using an Alternate Path or Channel

Description: CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path.

CVSS: CRITICAL (9.8)

EPSS Score: 0.06%

Source: CVE

June 9th, 2025 (4 days ago)

CVE-2025-30183

CyberData 011209 SIP Emergency Intercom Insufficiently Protected Credentials

Description: CyberData 011209 Intercom does not properly store or protect web server admin credentials.

CVSS: HIGH (7.5)

EPSS Score: 0.03%

Source: CVE

June 9th, 2025 (4 days ago)

CVE-2025-26468

CyberData 011209 SIP Emergency Intercom Missing Authentication for Critical Function

Description: CyberData 011209 Intercom exposes features that could allow an unauthenticated to gain access and cause a denial-of-service condition or system disruption.

CVSS: HIGH (7.5)

EPSS Score: 0.04%

Source: CVE

June 9th, 2025 (4 days ago)

Stolen Ticketmaster data from Snowflake attacks briefly for sale again

Description: The Arkana Security extortion gang briefly listed over the weekend what appeared to be newly stolen Ticketmaster data but is instead the data stolen during the 2024 Snowflake data theft attacks. [...]

Source: BleepingComputer

June 9th, 2025 (4 days ago)

CVE-2025-5898

GNU PSPP pspp-convert.c parse_variables_option out-of-bounds write

Description: A vulnerability classified as critical has been found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected is the function parse_variables_option of the file utilities/pspp-convert.c. The manipulation leads to out-of-bounds write. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Es wurde eine kritische Schwachstelle in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb entdeckt. Es betrifft die Funktion parse_variables_option der Datei utilities/pspp-convert.c. Durch das Manipulieren mit unbekannten Daten kann eine out-of-bounds write-Schwachstelle ausgenutzt werden. Der Angriff hat dabei lokal zu erfolgen. Der Exploit steht zur öffentlichen Verfügung.

CVSS: MEDIUM (5.3)

EPSS Score: 0.01%

Source: CVE

June 9th, 2025 (4 days ago)

Threat and Vulnerability Intelligence Database

Example Searches: