CVE-2025-1792

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint...

CVE-2025-1792 Improper Access Control in Mattermost Channel Member API

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint...

CVE-2025-1792 Improper Access Control in Mattermost Channel Member API

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint...

CVE-2025-1792

CVE-2025-1792 affects Mattermost Server: 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x

CVE-2025-1792 Improper Access Control in Mattermost Channel Member API

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an Improper Access Control vulnerability that stems from a failure to properly access control, which can be exploited by an attacker to view metadata about members of a public...

CVE-2025-48482: Improper Enforcement of Behavioral Workflow

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, there is a mass assignment vulnerability. The Customer object is updated using the fill method, which processes fields such as channel and channelid. However, the fill method is called with all client-provided...

CVE-2025-1792: Incorrect Authorization

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint...

Fedora 41 : ruff / rust-hashlink / rust-rusqlite (2025-575023fff7)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-575023fff7 advisory. Security update for CVE-2025-4574, GHSA-pg9f-39pc-qf8g: by rebuilding ruff, we ensure that it uses version 0.5.15 of the crossbeam-channel crate library. ---...

CVE-2025-46204

creationtimestamp| type| source ---|---|--- 2025-05-29 19:36:32+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/38577...

CVE-2025-46570

The CVE-2025-46570 entry concerns vLLM (inference/serving engine). The concrete detail across connected records shows a vulnerability in the PageAttention-based prefill path: when a new prompt is processed, a matching prefix chunk can accelerate prefill, creating timing differences (TTFT) that co...

CVE-2025-46570 vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel

vLLM is an inference and serving engine for large language models LLMs. Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT Time to First Token. These timing differences...

CVE-2025-46570 vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel

vLLM is an inference and serving engine for large language models LLMs. Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT Time to First Token. These timing differences...

SUSE-SU-2025:01464-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2025-43965: Fixed mishandling of image depth after SetQuantumFormat is used in MIFF image processing. bsc1241659 - CVE-2025-46393: Fixed mishandling of packetsize leads to rendering of channels in arbitrary order in multispectral MIFF...

GHSA-4QJH-9FV9-R85R Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

This issue arises from the prefix caching mechanism, which may expose the system to a timing side-channel attack. Description When a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT Time to First...

Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

This issue arises from the prefix caching mechanism, which may expose the system to a timing side-channel attack. Description When a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT Time to First...

Transformers for Secure Hardware Systems: Applications, Challenges, and Outlook

The rise of hardware-level security threats, such as side-channel attacks, hardware Trojans, and firmware vulnerabilities, demands advanced detection mechanisms that are more intelligent and adaptive. Traditional methods often fall short in addressing the complexity and evasiveness of modern...

PT-2025-23135 · Vllm · Vllm

Name of the Vulnerable Software and Affected Versions: vLLM versions prior to 0.9.0 Description: The issue arises from the prefix caching mechanism in vLLM, which may expose the system to a timing side-channel attack. When a new prompt is processed, if the PageAttention mechanism finds a matching...

GHSA-G88V-2J67-9RMX

creationtimestamp| type| source ---|---|--- 2025-05-27 04:47:50+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17602...

ABB M2M Gateway Information Disclosure in embedded Linux Kernel for some AMD CPUs (CVE-2023-20569)

A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. This plugin only works with Tenable.ot. Please visit...