11621 matches found
CVE-2025-36037
IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
CVE-2025-41716
The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function...
CVE-2025-41716 Unauthenticated User Enumeration via Missing Authentication
The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function...
CVE-2025-41716
CVE-2025-41716 describes an unauthenticated information disclosure where a remote attacker can enumerate existing user accounts and their roles due to missing authentication for a critical function. Connected sources reference WAGO Device Sphere and WAGO Solution Builder as affected, describing a...
CVE-2025-41716 Unauthenticated User Enumeration via Missing Authentication
The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function...
CVE-2025-9031
Summary: CVE-2025-9031 affects DivvyDrive Web by Observable Timing Discrepancy allowing Cross-Domain Search Timing. PT-2025-39236 specifies DivvyDrive Web versions 4.8.2.2 through 4.8.2.15 as affected and attributes the issue to an observable timing discrepancy; it recommends upgrading to a versi...
CVE-2025-9031 Timing-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web
Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing. This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15...
CVE-2025-9031 Timing-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web
Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing. This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15...
PT-2025-39238
Name of the Vulnerable Software and Affected Versions Web Application affected versions not specified Description The web application has a flaw that allows an unauthenticated remote attacker to gather information about existing user accounts, including their roles, due to a lack of authenticatio...
CVE-2025-36037
IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
CVE-2025-36037 IBM webMethods Integration server-side request forgery
IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
CVE-2025-36037
IBM webMethods Integration Server (on‑prem) versions 10.15 and 11.1 are affected by a server‑side request forgery (SSRF) vulnerability (CVE-2025-36037). The issue allows an authenticated attacker to cause unauthorized requests from the server, potentially enabling network enumeration. Remediation...
Sensitive Information Disclosure
Liferay Portal is vulnerable to Sensitive Information Disclosure.The vulnerability is due to improper tenant isolation because admin users of a virtual instance can add pages outside the default instance, allowing tenants to enumerate all other tenants...
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost versions 10.5.8 and prior 10.5.x and 9.11.17 and prior 9.11.x, which stems from insufficient access control validation and could cause an authenticated use...
Mattermost boards plugin fails to restrict download access to files
Mattermost versions 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration...
CVE-2025-9081
Mattermost versions 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration...
CVE-2025-9081 IDOR in board file download allows any user to download any file by UUID
Mattermost versions 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration...
CVE-2025-9081 IDOR in board file download allows any user to download any file by UUID
Mattermost versions 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration...
