CVE-2025-56447: Improper Authentication

TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure...

RT Systems TM2 Monitoring has a security vulnerability

RT Systems TM2 Monitoring is an environmental monitoring device from RT Systems of South Africa. A security vulnerability exists in RT Systems TM2 Monitoring version 3.04 that stems from authentication bypass and plaintext credential disclosure...

Ghost Robotics Vision 60 Trust Management Vulnerability

Ghost Robotics Vision 60 is a quadrupedal ground robot from Ghost Robotics, USA. A trust management issue vulnerability exists in Ghost Robotics Vision 60 version v0.27.2, which stems from the lack of an authentication mechanism for the physical interface, which could allow an attacker to access...

ZOHO ManageEngine Applications Manager Information Disclosure Vulnerability (CNVD-2025-29926)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. An information disclosure...

CVE-2025-56447

RT Systems TM2 Monitoring version 3.04 is affected by a vulnerability involving an authentication bypass and plaintext credential disclosure . This flaw stems from deficiencies in the authentication process, which could allow a malicious actor to disclose protected information. No specific remedi...

CVE-2025-56447

TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure...

AWS Outage: Lessons Learned

What can we learn from the recent AWS outage, and how can we apply those lessons to our own infrastructure? What Happened? On October 20, 2025 , AWS experienced a major disruption that rippled across the internet and social media, affecting widely used services such as Zoom, Microsoft Teams, Slac...

EUVD-2025-35164

All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the network to read the transmitted sensitive data. An attacker can also freely modify the data on the wire. The monitoring clients transmit the...

EUVD-2025-35159

An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login prompt in the WorkExaminer Professional console to gain administrative access to the WorkExaminer server and therefore all sensitive...

CVE-2025-10641

All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the network to read the transmitted sensitive data. An attacker can also freely modify the data on the wire. The monitoring clients transmit the...

CVE-2025-10641 Unencrypted cleartext communication in EfficientLab WorkExaminer Professional

All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the network to read the transmitted sensitive data. An attacker can also freely modify the data on the wire. The monitoring clients transmit the...

CVE-2025-10641

WorkExaminer Professional software is vulnerable to cleartext transmission of sensitive information. All traffic between the monitoring client , console , and server is transmitted without encryption, allowing an attacker with network access to read sensitive data or modify information on the wir...

CVE-2025-10640

The WorkExaminer Professional employee monitoring software is vulnerable to an authentication bypass due to missing server-side authentication checks . An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can circumvent the login prompt of the professional console....

ZOHO ManageEngine Applications Manager security vulnerabilities

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. An information disclosure...

Work Examiner Professional Security Vulnerabilities

Work Examiner Professional is an employee computer monitoring software from Work Examiner USA. A security vulnerability exists in Work Examiner Professional that stems from a lack of authentication checks on the server side, which could allow an unauthenticated attacker to bypass the login prompt...

Nightingale monitoring SQL Injection

The vulnerability of the Nightingale monitoring and notification system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This...

CVE-2025-47410: Cross-Site Request Forgery (CSRF)

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This...

Security update for chrony

This update for chrony fixes the following issues: Update to version 4.8: Add maxunreach option to limit selection of unreachable sources Add -u option to chronyc to drop root privileges default chronyc user is set by configure script Fix refclock extpps option to work on Linux = 6.15 Validate...

Prosper data breach puts 17 million people at risk of identity theft

Peer-to-peer lending marketplace Prosper detected unauthorized activity on their systems on September 2, 2025. It published an FAQ page later that month to address the incident. During the incident, the attacker stole personal information belonging to Prosper customers and loan applicants. As...