CVE-2025-34xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
979 records · Page 5 of 10
This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordA heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). This flaw is reachable without authentication and results from improper bounds checking when processing attacker-controlled input. By sending specially crafted data, a remote attacker can corrupt heap memory, potentially causing a denial of service or enabling
UpdatedA heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP). This flaw can be triggered without authentication by sending specially crafted input to the target system. Improper bounds checking allows an attacker to overwrite heap memory, potentially leading to application crashes or remote code execution. Exploitation occurs in the context
UpdatedA reflected cross-site scripting (XSS) vulnerability exists in the web interface of the Arcserve Unified Data Protection (UDP), where unsanitized user input is improperly reflected in HTTP responses. This flaw allows remote attackers with low privileges to craft malicious links that, when visited by another user, execute arbitrary JavaScript in the victim’s browser. Successful exploitation may lea
UpdatedAn authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected functionality or user accounts. By manipulating specific request parameters or exploiting a logic flaw, an attacker can bypass login mechanisms without valid credentials and access administrator-level features. This vulnerability affects all UDP
UpdatedIlevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an insecure hashing algorithm vulnerability. The product stores passwords using the MD5 hash function without applying a per‑password salt. Because MD5 is a fast, unsalted hash, an attacker who obtains the password database can efficiently perform offline dictionary, rainbow‑table, or brute‑force attacks to recover the original passwor
UpdatedIlevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
UpdatedIlevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an absolute path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
UpdatedIlevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
UpdatedIlevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
UpdatedIlevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec() and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
UpdatedIlevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an OS command injection vulnerability in mbus_build_from_csv.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
UpdatedIlevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected cross-site scripting (XSS) vulnerability in index.php that allows an unauthenticated attacker to execute arbitrary script in the victim's browser. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
UpdatedSitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution.
UpdatedSitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.
UpdatedSitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
UpdatedA path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo users, retrieve files on the host system, or cause a denial of service.
UpdatedThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordWBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed.
UpdatedThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordKodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate the 'link' parameter. Attackers can craft malicious URLs in the link parameter to redirect users to arbitrary external websites after authentication.
UpdatedDeck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates modern secure-boot or signed-update mechanisms, affected systems should be physically protected or retired from service. The vendor has not indi
UpdatedDeck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem and gain persistent code execution on reboot. This weakness allows long-term firmware tampering that survives power cycles. The vendor indicates t
UpdatedDeck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative
UpdatedDeck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing pe
Updated