NVD disclosure day
CVE-2025-34523
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical flaw in Arcserve UDP allows unauthenticated attackers to crash the service or possibly run their own code remotely, affecting data protection operations. Address this now to prevent disruption.
CVE-2025-34522
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A heap-based buffer overflow vulnerability exists in Arcserve Unified Data Protection's input parsing, allowing unauthenticated attackers to potentially execute code by sending crafted input. This pre-authentication flaw poses a high risk to system integrity and availability.
CVE-2025-34163
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An external attacker could run malicious code on servers running Dongsheng Logistics Software by uploading a crafted file. This could allow them to gain control of the system, potentially impacting sensitive logistics data and operations.
CVE-2025-34162
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
An external attacker could steal sensitive patient data or bypass login for the Bian Que system, impacting critical emergency information and leading to unauthorized access.
CVE-2024-13985
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A command injection vulnerability in Dahua EIMS allows unauthenticated remote attackers to execute arbitrary system commands. This occurs due to improper input validation in a specific interface, potentially leading to full system compromise if reachable. The vulnerability is relevant for systems where this interface i
CVE-2024-13984
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A path traversal vulnerability in QiAnXin TianQing Management Center's rptsvr component allows unauthenticated attackers to upload files to arbitrary server locations, potentially leading to remote code execution. This impacts management software, a central control point, and requires confirmation of its use within the
CVE-2024-13981
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An arbitrary file upload vulnerability in LiveBOS allows unauthenticated attackers to upload malicious files, potentially leading to remote code execution and system compromise. This issue affects the LiveBOS Server component via its UploadFile.do endpoint and is presumed to impact versions prior to August 2024.
CVE-2024-13980
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical remote command execution vulnerability exists in H3C Intelligent Management Center's web interface. Unauthenticated attackers can exploit this by sending specially crafted requests to a network-reachable endpoint, potentially leading to arbitrary command execution on affected systems. Confirmation of the man
CVE-2023-7309
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A path traversal vulnerability in the Dahua Smart Park Integrated Management Platform's file upload interface allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution. Exploitation could result in full system compromise. It is uncertain if the specific affected versions a
CVE-2025-34161
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Coolify, a platform for managing application deployments, has a critical vulnerability enabling authenticated users with low-level privileges to execute arbitrary shell commands via the Git Repository field during project creation, potentially leading to full server compromise.
CVE-2025-34159
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Coolify versions prior to v4.0.0-beta.420.6 have a critical remote code execution vulnerability. Authenticated users with low-level privileges can inject malicious Docker Compose directives during project creation, potentially leading to full root access on the underlying server by mounting the host's filesystem. This
CVE-2025-34157
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Coolify, enabling low-privilege users to execute malicious scripts via crafted project names. This stored cross-site scripting flaw, when triggered by an administrator action, can lead to a full Coolify instance compromise, including the theft of sensitive data and access to managed s