Security Vulnerabilities - CVEs Published In May 2025
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter in the web_rmon_alarm_post_rmon_alarm function.
CVSS Score
6.5
EPSS Score
0.003
Published
2025-05-21
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4BasedAceAdd function.
CVSS Score
6.5
EPSS Score
0.003
Published
2025-05-21
AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.
CVSS Score
6.5
EPSS Score
0.061
Published
2025-05-21
Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to write arbitrary files
CVSS Score
8.7
EPSS Score
0.003
Published
2025-05-21
Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.
CVSS Score
8.2
EPSS Score
0.003
Published
2025-05-21
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
CVSS Score
6.8
EPSS Score
0.002
Published
2025-05-21
Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.
CVSS Score
8.3
EPSS Score
0.007
Published
2025-05-21
Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.
CVSS Score
6.9
EPSS Score
0.002
Published
2025-05-21
Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.
CVSS Score
8.2
EPSS Score
0.003
Published
2025-05-21
A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.html of the component Search. The manipulation of the argument keyword leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score
5.3
EPSS Score
0.002
Published
2025-05-21