Threat and Vulnerability Intelligence Database

RSS Feed

Example Searches:

CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
🏴‍☠️ Lynx has just published a new victim : Diyar
Description: www.diyar.com - Architecture, Engineering & Design
Source: Ransomware.live
June 2nd, 2025 (about 7 hours ago)

CVE-2025-5086
Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
Description: A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.

CVSS: CRITICAL (10.0)

Source: CVE
June 2nd, 2025 (about 7 hours ago)

CVE-2025-45387
osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.
Description: osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.
Source: CVE
June 2nd, 2025 (about 7 hours ago)

CVE-2025-27956
Directory Traversal vulnerability in WebLaudos 24.2 (04) allows a remote attacker to obtain sensitive information via the id parameter.
Description: Directory Traversal vulnerability in WebLaudos 24.2 (04) allows a remote attacker to obtain sensitive information via the id parameter.
Source: CVE
June 2nd, 2025 (about 7 hours ago)

CVE-2025-27955
Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker...
Description: Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information and execute arbitrary code.
Source: CVE
June 2nd, 2025 (about 7 hours ago)

CVE-2025-27954
An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the...
Description: An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the usertoken function of default.aspx.
Source: CVE
June 2nd, 2025 (about 7 hours ago)

CVE-2025-27953
An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the...
Description: An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the session management component.
Source: CVE
June 2nd, 2025 (about 7 hours ago)

CVE-2025-23104
An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege...
Description: An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation.
Source: CVE
June 2nd, 2025 (about 7 hours ago)

CVE-2025-20298
Incorrect permission assignment on Universal Forwarder for Windows during new installation or upgrade
Description: In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory (by default, C:\Program Files\SplunkUniversalForwarder). This lets non-administrator users on the machine access the directory and all its contents.

CVSS: HIGH (8.0)

SSVC Exploitation: none

Source: CVE
June 2nd, 2025 (about 7 hours ago)

CVE-2025-20297
Reflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation component
Description: In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the pdfgen/render REST endpoint that could result in execution of unauthorized JavaScript code in the browser of a user.

CVSS: MEDIUM (4.3)

SSVC Exploitation: none

Source: CVE
June 2nd, 2025 (about 7 hours ago)