2348 matches found
CVE-2025-46827
Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with...
CVE-2025-1993: Weak Password Requirements
IBM App Connect Enterprise Certified Container 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, 12.7, 12.8, 12.9, and 12.10 DesignerAuthoring instances store their flows in a database that is protected by weaker than expected...
Vulnerability of software for managing IBM Engineering Requirements Management DOORS: Next, a vulnerability related to insufficient protection of registration data, which allows attackers to disclose protected information.
The vulnerability of the IBM Engineering Requirements Management DOORS Next software lies in the insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to disclose the protected information remotely...
Driver Disk for Emulex lpfc 14.4.393.31 - For XenServer 8.4
Who should install this driver disk? Customers running the XenServer 8.4 release who use Emulex's lpfc driver and wish to use the latest version of the following: Driver Module| Driver Type| Version ---|---|--- lpfc| Fibre Channel HBA/Storage Controller| 14.4.393.31 Required firmware versions The...
CVE-2025-26847: Weak Password Requirements
An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked...
Exploit for Out-of-bounds Write in F5 Nginx
🛡️ Nginx Vulnerability Scanner Desarrollado por m10sec. E...
Do Not Allow Unused Users
If service-irrelevant users exist in the system, attackers may use them to launch attacks. Only users required by services are retained in the system. Other users used for installation, deployment, commissioning, verification, and fault locating must be deleted. By default, unused users do not...
Do Not Install the LDAP Service
Lightweight Directory Access Protocol LDAP is a protocol that provides access control and is used to maintain distributed directory information. The LDAP service increases system resource usage and expands the attack surface. If the LDAP service is not required, do not install the LDAP service. T...
Do Not Install the Telnet Client
Telnet is an application-layer protocol and is usually used for remote login, operation control, and system modification of servers. Telnet data is not encrypted, and user names, passwords, and transmitted data can be easily stolen by attackers. Therefore, do not install or use Telnet clients. Us...
Do Not Install the LDAP Client
Lightweight Directory Access Protocol LDAP is a protocol that provides access control and is used to maintain distributed directory information. Running the LDAP service requires additional system resources and expands the attack surface. Therefore, do not install the LDAP client in the service...
Disable PermitUserEnvironment
PermitUserEnvironment allows users to set SSH environment variables, which may be exploited by attackers to launch attacks. If PermitUserEnvironment is set to yes, attackers can modify SSH environment variables to evade the security mechanism or execute attack code. This configuration must be...
Ensure That the Password Protection Is Configured in Single-User Mode
You can edit the GRUB startup menu and add the s or single command to the Linux startup command line to enter the single-user mode, which is an emergency rescue mode. In this mode, system data can be modified. For example, users can change the password of the root user. In this case, the password...
Do Not Use Historical Passwords
Using the same historical password frequently may cause password leakage and attacks. To ensure user security, the function of disabling historical passwords must be configured. The number of historical passwords that cannot be used must be properly set based on the actual service scenario. The...
Configure the dmesg Access Permission Properly
The permission to access dmesg information is restricted. Unprivileged users cannot view system information. This prevents any one from obtaining sensitive information and attacking the system. Only processes with the CAPSYSLOG capability are allowed to access kernel logs. In this way, the least...
CVE-2025-46731
Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and ALLOWADMINCHANGES must be enabled for this to work...
NetScaler RDP proxy -14.1- How to configure RDP proxy with RDS server
This article explains how to configure an RDP Proxy Gateway with an RDS server. Key Points to Note: -If you are using an RDS server, you will need an RDP server profile where the RDP IP is set as the RDS server IP. -For the RDP Host, enter the FQDN of the Gateway Virtual Server. This is required...
Exploit for SQL Injection in Plechevandrey Wp-Recall
cve-2025-1323 WP-Recall Plugin SQL Injection ⚠️ Legal Dis...
Google Chrome Security Update(stable-channel-update-for-desktop_29-2025-04) - Mac OS X
Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...
Ubuntu: Security Advisory (USN-7423-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...