PT-2025-38740

Name of the Vulnerable Software and Affected Versions Creacast Creabox Manager version 4.4.4 Description The software exposes sensitive configuration data through a publicly accessible endpoint. Accessing the /get endpoint returns internal configuration details, including the creacodec.lua file,...

PT-2025-39071

Name of the Vulnerable Software and Affected Versions mailgen versions prior to 2.0.30 Description mailgen is a Node.js package used to generate responsive HTML e-mails. A HTML injection flaw exists in plaintext e-mails generated by the software when using the Mailgen.generatePlaintextemail metho...

CVE-2025-59526: Improper Neutralization of Input During Web Page Generation

mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Prior to version 2.0.30, there is an HTML injection vulnerability in plaintext e-mails generated by Mailgen. Projects are affected if the Mailgen.generatePlaintextemail method is used and given...

CVE-2025-57430: Exposure of Sensitive Information to an Unauthorized Actor

Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When accessed, this endpoint returns internal configuration including the creacodec.lua file, which contains plaintext admin credentials...

Incorrect handling of embedded SVG and MathML leads to mutation XSS after removal

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML. This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being...

Vasion Print Virtual Appliance Host和Vasion Print Application 安全漏洞

Vasion Print Virtual Appliance Host and Vasion Print Application are both products of Vasion Corporation of the U.S.A. Vasion Print Virtual Appliance Host is a print management software.Vasion Print Application is a printer management application. A security vulnerability exists in Vasion Print...

Vasion Print和Vasion Print Virtual Appliance Host 安全漏洞

Vasion Print and Vasion Print Virtual Appliance Host are both products of Vasion, Inc.Vasion Print is a SaaS-based cloud hosted application for managing and deploying printers.Vasion Print Virtual Appliance Host is a print management software. A security vulnerability exists in Vasion Print Virtu...

PT-2025-38624

A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.errorstr + "decode failed", e. If the input parameter contains sensitive information such as Hive Metastore keys, plaintext...

CVE-2025-34183

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential...

CVE-2025-50110

An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sensitive information - including internal server URLs, account IDs, passwords, and device tokens - as plaintext query parameters over HTTPS...

DragonFly's tiny file download uses hard coded HTTP protocol

The code in the scheduler for downloading a tiny file is hard coded to use the HTTP protocol, rather than HTTPS. This means that an attacker could perform a Man-in-the-Middle attack, changing the network request so that a different piece of data gets downloaded. Due to the use of weak integrity...

CVE-2025-34183

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential...

CVE-2025-34183

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential...

CVE-2025-34183 Ilevia EVE X1 Server 4.7.18.0.eden Credentials Leak Through Log Disclosure

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential...

CVE-2025-34183

Ilevia EVE X1 Server (≤ 4.7.18.0.eden) contains a server-side logging flaw that allows unauthenticated remote attackers to read plaintext credentials from exposed .log files, enabling full authentication bypass and potential system compromise via credential reuse. Additional risk factors in the r...

PT-2025-38073

Name of the Vulnerable Software and Affected Versions Ilevia EVE X1 Server versions 4.7.18.0 and earlier Description The server-side logging mechanism in Ilevia EVE X1 Server contains a flaw that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. Th...

CVE-2025-50110

An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sensitive information - including internal server URLs, account IDs, passwords, and device tokens - as plaintext query parameters over HTTPS...

CVE-2025-50110

An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sensitive information - including internal server URLs, account IDs, passwords, and device tokens - as plaintext query parameters over HTTPS...

CVE-2025-50110

The AVTECH EagleEyes Lite (version 2.0.0) Android application contains a vulnerability where the GetHttpsResponse method transmits sensitive data, including account IDs, passwords, device tokens, and internal server URLs , as plaintext query parameters over HTTPS. On devices running Android versi...

CVE-2025-50110

An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sensitive information - including internal server URLs, account IDs, passwords, and device tokens - as plaintext query parameters over HTTPS...