cve.bz

OWASP A06:2025 Insecure Design vulnerabilities, newest first, page 193

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A06:2025 at MITRE.

Its weaknesses: 39

CWE-73, CWE-183, CWE-256, CWE-266, CWE-269, CWE-286, CWE-311, CWE-312, CWE-313, CWE-316, CWE-362, CWE-382, CWE-419, CWE-434, CWE-436, CWE-444, CWE-451, CWE-454, CWE-472, CWE-501, CWE-522, CWE-525, CWE-539, CWE-598, CWE-602, CWE-628, CWE-642, CWE-646, CWE-653, CWE-656, CWE-657, CWE-676, CWE-693, CWE-799, CWE-807, CWE-841, CWE-1021, CWE-1022, CWE-1125

  1. 9.8CVE-2024-9636EPSS 0.8%

    The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This m…

  2. 9.2CVE-2024-12297EPSS 0.8%

    Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in i…

  3. 6.3CVE-2025-21101EPSS 0.1%

    Dell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability. A local malicious user could potentially exploit this vulnerability during installation, leading to arbitrary folder or file deletion.

  4. 8.1CVE-2024-57761EPSS 0.5%

    An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file.

  5. 9.8CVE-2024-48760ExploitEPSS 46%

    An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi file that overwrites the original upload.cgi file, enabling remote command executi…

  6. 7.8CVE-2025-21360EPSS 0.5%

    Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability

  7. 7.8CVE-2025-21346EPSS 0.7%

    Microsoft Office Security Feature Bypass Vulnerability

  8. 7.5CVE-2025-21343EPSS 1.4%

    Windows Web Threat Defense User Service Information Disclosure Vulnerability

  9. 6.5CVE-2025-21314EPSS 1.4%

    Windows SmartScreen Spoofing Vulnerability

  10. 7.8CVE-2025-21287EPSS 0.6%

    Windows Installer Elevation of Privilege Vulnerability

  11. 5.5CVE-2025-21278EPSS 0.6%

    Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability

  12. 7.5CVE-2025-21276EPSS 2.5%

    Windows MapUrlToZone Denial of Service Vulnerability

  13. 6.5CVE-2025-21217EPSS 2.0%

    Windows NTLM Spoofing Vulnerability

  14. 6.8CVE-2025-21211EPSS 0.8%

    Secure Boot Security Feature Bypass Vulnerability

  15. 7.8CVE-2024-13171EPSS 18%

    Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is requ…

  16. 5.6CVE-2024-12747EPSS 0.4%

    A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a …

  17. 5.3CVE-2025-0463EPSS 0.4%

    A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0. It has been classified as critical. Affected is an unknown function of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action…

  18. 6.9CVE-2025-0460EPSS 0.5%

    A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blog_add. The manipulation of the argument image leads …

  19. 7.8CVE-2024-33503EPSS 0.2%

    A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2…

  20. 8.8CVE-2025-0394EPSS 1.2%

    The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gh_big_file_upload() function in all versions…

  21. 6.5CVE-2024-11734EPSS 0.9%

    A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This action is done by modifying any of the security headers and inserting newl…

  22. 8.8CVE-2024-12398EPSS 0.5%

    An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware versions through 6.70(ACGG.2) could allow an authenticated user with limited pri…

  23. 4.8CVE-2025-0057EPSS 0.2%

    SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the atta…

  24. 8.4CVE-2024-11128EPSS 0.2%

    A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) without being blocked by AppleMobileFileIntegrity (AMFI). This issue is caused by th…

  25. 6.5CVE-2023-42248EPSS 0.4%

    An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can write arbitrary files by manipulating POST parameters of the page "common/vam_Sql.php".

  26. 6.3CVE-2025-23027EPSS 0.3%

    next-forge is a Next.js project boilerplate for modern web application. The BASEHUB_TOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems.

  27. 7.2CVE-2024-46480EPSS 0.5%

    An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privileges on the underlying host system.

  28. 8.8CVE-2024-46479EPSS 0.8%

    Venki Supravizio BPM through 18.0.1 was discovered to contain an arbitrary file upload vulnerability. An authenticated attacker may upload a malicious file, leading to remote code execution.

  29. 5.3CVE-2025-0402EPSS 0.4%

    A vulnerability classified as critical was found in 1902756969 reggie 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argumen…

  30. 5.1CVE-2025-0399EPSS 0.4%

    A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file src/main/java/com/siro/mall/controller/common/uploadController.java. The manipu…

  31. 9.8CVE-2024-42180EPSS 0.3%

    HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and …

  32. 7.0CVE-2024-57876EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Fix resetting msg rx state after topology removal If the MST topology is removed during the reception of an MST down reply or MST up request sideband message…

  33. 4.7CVE-2024-56788EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: ethernet: oa_tc6: fix tx skb race condition between reference pointers There are two skb pointers to manage tx skb's enqueued from n/w stack. waiting_tx_skb pointer…

  34. 9.8CVE-2024-42172EPSS 0.4%

    HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity theft and system control. This vulnerability arises from poor configuration, logi…

  35. 6.9CVE-2025-0105EPSS 13%

    An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem.

  36. 4.6CVE-2024-7142EPSS 0.10%

    On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption might not be successfully performed. This results in the disks remaining unsecured …

  37. 7.6CVE-2024-47520EPSS 0.4%

    A user with advanced report application access rights can perform actions for which they are not authorized

  38. 9.4CVE-2025-22152EPSS 0.6%

    Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These v…

  39. 7.2CVE-2024-46210EPSS 0.6%

    An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file.

  40. 9.1CVE-2024-46505EPSS 0.3%

    Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.

  41. 5.3CVE-2024-13274EPSS 0.4%

    Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.

  42. 8.8CVE-2024-13251EPSS 0.4%

    Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1.

  43. 5.5CVE-2024-13248EPSS 0.2%

    Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.

  44. 10.0CVE-2025-22504EPSS 0.5%

    Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms 4ecps-webforms allows Upload a Web Shell to a Web Server.This issue affects 4ECPS Web Forms: from n/a through <= 0.2.18.

  45. 5.1CVE-2025-0346EPSS 0.6%

    A vulnerability was found in code-projects Content Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/publishnews.php of the component Publish News Page. The manipulation of the argum…

  46. 5.3CVE-2025-0341EPSS 0.5%

    A vulnerability, which was classified as critical, has been found in CampCodes Computer Laboratory Management System 1.0. Affected by this issue is some unknown functionality of the file /class/edit/edit. The manipulation of the argument e…

  47. 5.3CVE-2024-43662EPSS 0.6%

    The <redacted>.exe or <redacted>.exe CGI binary can be used to upload arbitrary files to /tmp/upload/ or /tmp/ respectively as any user, although the user interface for uploading files is only shown to the iocadmin user. This issue affect…

  48. 8.3CVE-2024-43659EPSS 0.8%

    After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the same across all Iocharger AC model EV chargers. This issue affects Iocharger firmware for AC model…

  49. 7.2CVE-2024-43658EPSS 0.6%

    Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary files This issue affects Iocharger firmware for AC model before firmware version 25010801. Likelihood: High, but requires…

  50. 9.3CVE-2024-43657EPSS 1.5%

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701. Likelihood: High. …