CVE-2025-27494

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.9, SiPass integrated ACC-AP All versions V6.4.9. Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileg...

ABB RMC-100

SUMMARY An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop. 2. WORKAROUNDS The vulnerability is only present when the REST interface is enabled...

WordPress plugin REST API TO MiniProgram 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2025-10746 · Unknown · Sipass Integrated Acc-Ap +1

Name of the Vulnerable Software and Affected Versions: SiPass integrated AC5102 ACC-G2 versions prior to V6.4.9 SiPass integrated ACC-AP versions prior to V6.4.9 Description: A vulnerability has been identified where affected devices improperly sanitize input for the "pubkey" endpoint of the REST...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=6.0.0 <=7.3.7) potentially affected by CVE-2025-27136 via io.github.robothy:local-s3-rest (>=1.10 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.10, =1.2, =6.0.0, =7.3.7 Source cves: CVE-2025-27136 Source advisory: SNYK:JAVA-IOGITHUBROBOTHY-9396840...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=7.3.1 <=7.3.7) potentially affected by unknown CVE via io.github.robothy:local-s3-rest (>=1.2 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.2, =1.2, =7.3.1, =7.3.7 Source cves: unknown CVE Source advisory: OSV:GHSA-47QW-CCJM-9C2C...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=6.0.0 <=7.3.7) potentially affected by unknown CVE via io.github.robothy:local-s3-rest (>=1.10 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.10, =1.2, =6.0.0, =7.3.7 Source cves: unknown CVE Source advisory: SNYK:JAVA-IOGITHUBROBOTHY-9399376...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection when parsing DTD files. External entities referenced in a malicious DTD document are resolved and retrieved. This allows attackers to expose information from internal URLs that are not meant to be...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=6.0.0 <=7.3.7) potentially affected by unknown CVE via io.github.robothy:local-s3-rest (>=1.10 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.10, =1.2, =6.0.0, =7.3.7 Source cves: unknown CVE Source advisory: SNYK:JAVA-IOGITHUBROBOTHY-9399367...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=7.3.1 <=7.3.7) potentially affected by unknown CVE via io.github.robothy:local-s3-rest (>=1.2 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.2, =1.2, =7.3.1, =7.3.7 Source cves: unknown CVE Source advisory: OSV:GHSA-V232-254C-M6P7...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=6.0.0 <=7.3.7) potentially affected by unknown CVE via io.github.robothy:local-s3-rest (>=1.10 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.10, =1.2, =6.0.0, =7.3.7 Source cves: unknown CVE Source advisory: SNYK:JAVA-IOGITHUBROBOTHY-9399373...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=7.3.1 <=7.3.7) potentially affected by unknown CVE via io.github.robothy:local-s3-rest (>=1.2 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.2, =1.2, =7.3.1, =7.3.7 Source cves: unknown CVE Source advisory: OSV:GHSA-2466-4485-4PXJ...

io.github.robothy:local-s3-jupiter (>=1.2 <=1.20), org.sdase.commons:sda-commons-server-s3-testing (>=7.3.1 <=7.3.7) potentially affected by CVE-2025-27136 via io.github.robothy:local-s3-rest (>=1.2 <=1.20)

io.github.robothy:local-s3-rest MAVEN version =1.2, =1.2, =7.3.1, =7.3.7 Source cves: CVE-2025-27136 Source advisory: OSV:GHSA-G6WM-2V64-WQ36...

BIT-JENKINS-2025-27622

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets...

BIT-JENKINS-2025-27623

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets...

CVE-2025-27623

A flaw was found in Jenkins. Affected versions of Jenkins do not redact encrypted values of secrets when accessing the config.xml of views via REST API or CLI. This flaw allows attackers with view/read permission to view encrypted values of secrets...

Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of views via REST API or CLI. This allows attackers with View/Read permission to view encrypted values of secrets. Jenkins 2.500, LTS 2.492.2 redacts the encrypted values of...

Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of agents via REST API or CLI. This allows attackers with Agent/Extended Read permission to view encrypted values of secrets. Jenkins 2.500, LTS 2.492.2 redacts the encrypted...

GHSA-P34J-R3CH-C985 Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of agents via REST API or CLI. This allows attackers with Agent/Extended Read permission to view encrypted values of secrets. Jenkins 2.500, LTS 2.492.2 redacts the encrypted...

Cleartext Storage of Sensitive Information

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information due to improper redaction of encrypted values in config.xml when accessed via REST API or CLI. An attacker with...