109 vulnerabilidades · Cloud Orden: CVSS EPSS Año ID
CVE-2025-26127
Software Genérico Web Cloud
5.0
MEDIUM
EPSS
0.1%
2025 1 PoC

A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Scanner Automatizado
Sin template local disponible
CVE-2025-30675
Apache CloudStack Web Cloud
4.7
MEDIUM
EPSS
0.4%
2025 CWE-200 1 PoC

In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attacker to gain unauthorized visibility into templates and ISOs under the ROOT domain. A malicious admin can enumerate and extract metadata of templates and ISOs that belong to unrelated domains, violating isolation boundaries and potentially exposing sensitive or internal configuration details.  This vul

Scanner Automatizado
Sin template local disponible
CVE-2025-22828
Apache CloudStack Web Cloud
4.3
MEDIUM
EPSS
18.4%
2025 CWE-200 1 PoC

CloudStack users can add and read comments (annotations) on resources they are authorised to access.  Due to an access validation issue that affects Apache CloudStack versions from 4.16.0, users who have access, prior access or knowledge of resource UUIDs can list and add comments (annotations) to such resources.  An attacker with a user-account and access or prior knowledge of resource UUIDs may exploit this issue to read contents of the comments (annotations) or add malicious comments (annotations) to such resources.  This may cause potential loss of confidentiality of CloudStack environm

Scanner Automatizado
Sin template local disponible
CVE-2025-30259
WhatsApp cloud service Cloud
3.5
LOW
EPSS
0.1%
2025 1 PoC

The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL.

Scanner Automatizado
Sin template local disponible
CVE-2025-54499
Mattermost Web Database Cloud
3.1
LOW
EPSS
0.0%
2025 CWE-208 1 PoC

Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets

Scanner Automatizado
Sin template local disponible
CVE-2025-56558
MQTT server Cloud
3.0
LOW
EPSS
0.0%
2025 CWE-420 1 PoC

The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and device serial number, even if a device (such as a Pure Hot+Cool device) has been removed and is not visible in the supported MyDyson app. This could allow an unexpected actor to obtain control and set the room temperature (up to 37 Celsius) if ownership of the device is transferred without wiping the device. NOTE: the Supplier's position is that this is a potential vulnerability that dates back 4 years

Scanner Automatizado
Sin template local disponible
CVE-2025-22829
Apache CloudStack Web Cloud
2.3
LOW
EPSS
0.5%
2025 CWE-269 1 PoC

The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations. Quota plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this issue.

Scanner Automatizado
Sin template local disponible
CVE-2025-0133
Cloud NGFW Web Networking Cloud ⚡ nuclei
1.2
LOW
EPSS
1.8%
2025 CWE-79 8 PoCs

A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link. The primary risk is phishing attacks that can lead to credential theft—particularly if you enabled Clientless VPN. There is no availability impact to GlobalProtect features or GlobalProtect users. Attackers cannot use this vulnerability to tamper with or modify contents or configurations of the GlobalPro

Scanner Automatizado
nuclei -t CVE-2025-0133.yaml ⎘
CVE-2025-21814
Linux Cloud
N/A
UNKNOWN
EPSS
0.0%
2025 1 PoC

In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure info->enable callback is always set The ioctl and sysfs handlers unconditionally call the ->enable callback. Not all drivers implement that callback, leading to NULL dereferences. Example of affected drivers: ptp_s390.c, ptp_vclock.c and ptp_mock.c. Instead use a dummy callback if no better was specified by the driver.

Scanner Automatizado
Sin template local disponible