Vuldb Updates

A vulnerability identified as critical has been detected in Sitecore Staging Module up to 5.4.0. This affects an unknown function of the file modules/staging/service/api.asmx of the component Webservice. This manipulation causes improper authentication. This vulnerability is registered as CVE-2009-4367. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability described as very critical has been identified in SoftCab Sound Converter ActiveX 1.2. Affected is the function SaveFormat of the file sndConverter.ocx of the component ActiveX Control. The manipulation results in exposed dangerous routine. This vulnerability is identified as CVE-2009-4453. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability was found in Yaws Web Server 1.85. It has been declared as critical. Impacted is an unknown function of the component Terminal. The manipulation results in improper input validation. This vulnerability is known as CVE-2009-4495. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability described as critical has been identified in Metz Connect Energy-Controlling EWIO2-M, Energy-Controlling EWIO2-M-BM and Ethernet-IO EWIO2-BM up to 2.1.x. The affected element is an unknown function. The manipulation results in path traversal: '.../...//'. This vulnerability was named CVE-2025-41736. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability classified as critical has been found in Metz Connect Energy-Controlling EWIO2-M, Energy-Controlling EWIO2-M-BM and Ethernet-IO EWIO2-BM up to 2.1.x. The impacted element is an unknown function. This manipulation causes improper access controls. The identification of this vulnerability is CVE-2025-41737. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Informática del Este WinPlus 24.11.27 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /WinplusPortal/ws/sWinplus.svc/json/uploadfile of the component POST Request Handler. The manipulation leads to unrestricted upload. This vulnerability is listed as CVE-2025-41347. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in Informática del Este WinPlus 24.11.27 and classified as critical. Affected by this issue is some unknown functionality of the file /WinplusPortal/ws/sWinplus.svc/json/getacumper_post of the component POST Request Handler. The manipulation of the argument val1/cont results in sql injection. This vulnerability is cataloged as CVE-2025-41348. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in PJSIP up to 2.13. It has been rated as critical. This vulnerability affects the function nameserver_count. The manipulation leads to heap-based buffer overflow. This vulnerability is documented as CVE-2023-27585. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability labeled as critical has been found in phpList 3.6.12. Affected by this vulnerability is an unknown functionality. The manipulation results in permission issues. This vulnerability is cataloged as CVE-2023-27576. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic was found in ShadowsocksX-NG 1.10.0. This issue affects some unknown processing. Executing manipulation can lead to privilege escalation. This vulnerability is tracked as CVE-2023-27574. The attack is only possible within the local network. No exploit exists. It is advisable to implement a patch to correct this issue.

A vulnerability, which was classified as critical, was found in CommScope Arris DG3450 AR01.02.056.18_041520_711.NCS.10. This vulnerability affects unknown code of the file /troubleshooting_logs_download.php?log_type=system&time_frame=today. The manipulation results in missing authentication. This vulnerability was named CVE-2023-27572. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability, which was classified as problematic, has been found in CommScope Arris DG3450 AR01.02.056.18_041520_711.NCS.10. This affects the function :: of the file /https_redirect.php. The manipulation of the argument page with the input %22;alert(document.domain);var%20dummy=%22 leads to cross site scripting. This vulnerability is uniquely identified as CVE-2023-27571. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability was found in Informática del Este WinPlus 24.11.27. It has been rated as problematic. This issue affects some unknown processing of the file /WinplusPortal/ws/sWinplus.svc/json/savesoldoc_post of the component Query Handler. Performing manipulation of the argument descripcion results in cross site scripting. This vulnerability is reported as CVE-2025-41350. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in WSO2 Open Banking AM, Open Banking IAM, Traffic Manager, Universal Gateway, API Control Plane, API Manager, Identity Server, Identity Server as Key Manager, Enterprise Integrator and org.wso2.carbon:org.wso2.carbon.ui. It has been classified as problematic. This affects an unknown part of the component Admin Service. This manipulation causes cross-site request forgery. This vulnerability is registered as CVE-2025-6670. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in Informática del Este WinPlus 24.11.27. It has been declared as problematic. This vulnerability affects unknown code of the file /WinplusPortal/ws/sWinplus of the component Query Handler. Such manipulation of the argument descripcion leads to cross site scripting. This vulnerability is documented as CVE-2025-41349. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in SolarWinds Serv-U. It has been classified as critical. Affected is an unknown function. The manipulation leads to escaping of output. This vulnerability is documented as CVE-2025-40547. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in GNOME libsoup. It has been declared as problematic. The affected element is an unknown function of the component Header Handler. Executing manipulation of the argument Range can lead to denial of service. This vulnerability appears as CVE-2025-32907. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in SolarWinds Serv-U. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation results in improper privilege management. This vulnerability is reported as CVE-2025-40548. The attack can be launched remotely. No exploit exists.

A vulnerability classified as problematic has been found in GNOME libsoup. Affected by this issue is some unknown functionality of the component Cookie Domain Handler. Performing manipulation results in improper handling of case sensitivity. This vulnerability is reported as CVE-2025-4035. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as problematic, was found in GNOME libsoup. The affected element is an unknown function of the component Authorization Header Handler. Executing manipulation can lead to information disclosure. This vulnerability is registered as CVE-2025-46421. It is possible to launch the attack remotely. No exploit is available.