Timing side-channel in Apache Tomcat's AJP secret comparison exposes the shared AJP connector secret to remote, unauthenticated attackers capable of making precise network timing measurements. The vulnerability, tracked as CWE-208 (Observable Timing Discrepancy), affects all major Tomcat branches from 7.0.0 through current releases prior to the fixed versions, and could allow an attacker to recover the AJP shared secret through repeated probing. No public exploit code exists at time of analysis, EPSS is 0.02%, and CISA SSVC rates exploitation as none - making real-world risk low despite the network-accessible attack vector.
Improper Input Validation in Adobe Commerce allows a high-privileged attacker to bypass security controls and gain unauthorized write access to the filesystem, with scope change crossing a security boundary. The vulnerability affects versions up to 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17, and 2.4.9-beta1. No public exploit has been identified at time of analysis, and EPSS sits at 0.04% (11th percentile), reflecting negligible real-world exploitation activity despite the scope-changed integrity impact.
SQL injection in SAP HANA Deployment Infrastructure (HDI) deploy library allows high-privileged users to manipulate dynamically constructed SQL queries, potentially altering SELECT statements and compromising confidentiality and availability. Attack requires local access and high privileges (PR:H), limiting real-world risk despite SQL injection severity. No public exploit code or active exploitation has been identified at the time of analysis.
Stack exhaustion in NanaZip's UFS/UFS2 filesystem image parser crashes the application when a user opens a specially crafted archive. Versions 5.0.1252.0 through 6.0.1698.0 (exclusive) are affected, with the flaw residing in the GetAllPaths function, which recurses into subdirectories without any depth ceiling or cycle-detection for inode loops. The impact is limited to a denial-of-service crash of the NanaZip process; no code execution or data exposure is possible. No public exploit and no active exploitation have been identified at time of analysis, and the EPSS score of 0.01% (2nd percentile) corroborates the low likelihood of real-world weaponization.
Memory exhaustion in NanaZip's littlefs filesystem image parser (versions 5.0.1252.0 through before 6.0.1698.0) allows a local denial-of-service condition when a victim opens a specially crafted archive. The parser's Open method blindly trusts the attacker-controlled BlockCount superblock field, and a 44-byte littlefs image with BlockCount set to 0xFFFFFFFF triggers approximately 4 billion heap allocations, exhausting available memory. No public exploit code URL is provided, though SSVC classifies exploitation status as proof-of-concept; the vulnerability is not listed in CISA KEV, and EPSS at 0.01% (2nd percentile) confirms minimal observed exploitation activity.
Integer divide-by-zero in NanaZip's UFS/UFS2 filesystem image parser crashes the application when a user opens a specially crafted archive. Affected versions 5.0.1252.0 through 5.x fail to validate the superblock field fs_ipg before using it as a divisor; setting it to zero in a crafted image triggers an immediate hardware trap and process termination. No public exploit has been identified and EPSS probability sits at 0.01% (2nd percentile), indicating negligible real-world exploitation risk at time of analysis.
NanaZip's UFS/UFS2 filesystem image parser crashes with a null-pointer dereference when a user opens a specially crafted archive. Affected versions 5.0.1252.0 through 6.0.1697.x fail to validate the type of the root inode before treating it as a directory: when inode 2 is typed IFLNK with a small di_size, the directory data buffer is allocated as zero-length and immediately dereferenced, crashing the application. No active exploitation has been identified (EPSS 0.01%, SSVC exploitation: none), and impact is limited to denial of service against the local NanaZip process.
Stack exhaustion in NanaZip's Electron Archive (ASAR) parser crashes the application when a user opens a specially crafted .asar file containing deeply nested JSON in the archive header. Versions 5.0.1252.0 through 6.0.1695.x are affected on Windows; exploitation requires local user interaction with no privilege escalation or code execution path. No public exploit exists and EPSS sits at 0.01% (2nd percentile), consistent with SSVC's 'Exploitation: none' signal - this is a low-priority denial-of-service fixed in the vendor-released 6.0.1698.0.
Sangoma Switchvox before version 8.4 stores SIP authentication credentials in cleartext within backup files, allowing local attackers with physical or filesystem access to recover credentials with low complexity. This information disclosure vulnerability affects systems using the default backup functionality and has a publicly documented proof-of-concept exploit available on GitHub.
OX Dovecot Pro is vulnerable to IMAP SETACL command injection that allows authenticated users to bypass the imap_acl_allow_anyone configuration setting and inject the anyone permission into dovecot-acl files, enabling spam of mailbox folders to all users. The vulnerability requires authentication and elevated complexity conditions (CVSS 3.1), and no public exploits are known at the time of analysis.
Hikvision Hik-Connect App fails to enforce strict directory access permissions, allowing other locally-installed applications to read sensitive information stored by the app on the device filesystem. The vulnerability requires local access and high attack complexity but poses information disclosure risk to users with multiple apps on the same device. No public exploit or active exploitation has been identified; CVSS score of 2.9 reflects the local-only attack vector and limited confidentiality impact.
Improper access control in Flowsint prior to version 1.2.3 permits authenticated users to modify the investigation metadata of any other user by supplying a known or guessed investigation ID, bypassing all ownership checks. The affected product is an open-source OSINT graph exploration platform used in cybersecurity investigation workflows. SSVC classifies exploitation status as poc with partial technical impact; EPSS of 0.04% (12th percentile) and a CVSS 4.0 score of 2.3 indicate very low real-world exploitation probability, though multi-user deployments conducting sensitive investigations face a meaningful data-integrity risk.
Fortinet FortiClient Windows versions 7.2 (all) and 7.4.0 through 7.4.2 contain a hard-coded cryptographic key vulnerability that allows high-privileged local attackers to disclose sensitive information. The vulnerability requires local access and administrator-level privileges, limiting its real-world exploitation scope to threats already present on compromised systems or malicious insiders. No public exploit code or active exploitation has been confirmed at the time of analysis.