CVE-2025-27494

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.9, SiPass integrated ACC-AP All versions V6.4.9. Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileg...

Information Disclosure

Jenkins is vulnerable to information disclosure. The vulnerability is due to improper redaction of encrypted secret values in config.xml when accessed via REST API or CLI, allowing attackers with View/Read permission to retrieve sensitive information...

CVE-2025-27494

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.9, SiPass integrated ACC-AP All versions V6.4.9. Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileg...

CVE-2025-27494

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.9, SiPass integrated ACC-AP All versions V6.4.9. Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileg...

CVE-2025-27494

CVE-2025-27494 affects Siemens SiPass integrated AC5102 (ACC-G2) and ACC-AP with all versions before V6.4.9. The issue stems from improper input sanitization at the REST API’s pubkey endpoint, enabling an authenticated remote administrator to inject commands that run with root privileges. Connect...

ABB RMC-100

SUMMARY An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop. 2. WORKAROUNDS The vulnerability is only present when the REST interface is enabled...

PT-2025-10746 · Unknown · Sipass Integrated Acc-Ap +1

Name of the Vulnerable Software and Affected Versions: SiPass integrated AC5102 ACC-G2 versions prior to V6.4.9 SiPass integrated ACC-AP versions prior to V6.4.9 Description: A vulnerability has been identified where affected devices improperly sanitize input for the "pubkey" endpoint of the REST...

WordPress plugin REST API TO MiniProgram 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=6.0.0 <=7.3.7) potentially affected by CVE-2025-27136 via io.github.robothy:local-s3-rest (>=1.10 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.10, =1.2, =6.0.0, =7.3.7 Source cves: CVE-2025-27136 Source advisory: SNYK:JAVA-IOGITHUBROBOTHY-9396840...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=6.0.0 <=7.3.7) potentially affected by unknown CVE via io.github.robothy:local-s3-rest (>=1.10 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.10, =1.2, =6.0.0, =7.3.7 Source cves: unknown CVE Source advisory: SNYK:JAVA-IOGITHUBROBOTHY-9399376...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection when parsing DTD files. External entities referenced in a malicious DTD document are resolved and retrieved. This allows attackers to expose information from internal URLs that are not meant to be...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=7.3.1 <=7.3.7) potentially affected by unknown CVE via io.github.robothy:local-s3-rest (>=1.2 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.2, =1.2, =7.3.1, =7.3.7 Source cves: unknown CVE Source advisory: OSV:GHSA-47QW-CCJM-9C2C...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=6.0.0 <=7.3.7) potentially affected by unknown CVE via io.github.robothy:local-s3-rest (>=1.10 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.10, =1.2, =6.0.0, =7.3.7 Source cves: unknown CVE Source advisory: SNYK:JAVA-IOGITHUBROBOTHY-9399367...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=7.3.1 <=7.3.7) potentially affected by unknown CVE via io.github.robothy:local-s3-rest (>=1.2 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.2, =1.2, =7.3.1, =7.3.7 Source cves: unknown CVE Source advisory: OSV:GHSA-V232-254C-M6P7...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=6.0.0 <=7.3.7) potentially affected by unknown CVE via io.github.robothy:local-s3-rest (>=1.10 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.10, =1.2, =6.0.0, =7.3.7 Source cves: unknown CVE Source advisory: SNYK:JAVA-IOGITHUBROBOTHY-9399373...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=7.3.1 <=7.3.7) potentially affected by unknown CVE via io.github.robothy:local-s3-rest (>=1.2 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.2, =1.2, =7.3.1, =7.3.7 Source cves: unknown CVE Source advisory: OSV:GHSA-2466-4485-4PXJ...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=7.3.1 <=7.3.7) potentially affected by CVE-2025-27136 via io.github.robothy:local-s3-rest (>=1.2 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.2, =1.2, =7.3.1, =7.3.7 Source cves: CVE-2025-27136 Source advisory: OSV:GHSA-G6WM-2V64-WQ36...

BIT-JENKINS-2025-27622

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets...

BIT-JENKINS-2025-27623

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets...

CVE-2025-27623

A flaw was found in Jenkins. Affected versions of Jenkins do not redact encrypted values of secrets when accessing the config.xml of views via REST API or CLI. This flaw allows attackers with view/read permission to view encrypted values of secrets...