2025-07-29 Daily Vulns

NEW:

CVE	vendor-product	description	metric	Referenceurl	title	GithubURL
CVE-2014-125115	Artica ST - Pandora FMS	An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash_data parameter, allowing attackers to extract administrator credentials or active session tokens via crafted requests. This occurs because input is directly concatenated into an SQL query without adequate validation, enabling SQL injection. After authentication is bypassed, a second vulnerability in the File Manager component permits arbitrary PHP file uploads. The file upload functionality does not enforce MIME-type or file extension restrictions, allowing authenticated users to upload web shells into a publicly accessible directory and achieve remote code execution.	CVSS4.0: 10 - CRITICAL	0 1 2 3 4	Exploitation: noneAutomatable: yesTechnical Impact: total	Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE	github
CVE-2023-53158	GitoxideLabs - gix-transport	The gix-transport crate before 0.36.1 for Rust allows command execution via the “gix clone ‘ssh://-oProxyCommand=open$IFS” substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.	CVSS3.1: 4.1 - MEDIUM	0 1 2 3	Exploitation: pocAutomatable: noTechnical Impact: partial	undefined	github
CVE-2023-53156	ejmahler - transpose	The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.	CVSS3.1: 4.5 - MEDIUM	0 1 2 3	Exploitation: noneAutomatable: noTechnical Impact: partial	undefined	github
CVE-2023-53157	rosenpass - rosenpass	The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet.	CVSS3.1: 5.3 - MEDIUM	0 1 2 3	Exploitation: noneAutomatable: yesTechnical Impact: partial	undefined	github
CVE-2022-50237	dalek-cryptography - ed25519-dalek	The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.	CVSS3.1: 5.9 - MEDIUM	0 1 2	Exploitation: noneAutomatable: noTechnical Impact: partial	undefined	github