186 matches found
cloud-init: Cloud init permissions flaw
An access permissions flaw was found in cloud-init. When a non-x86 platform is detected, cloud-init grants root access to a hardcoded URL with a local IP address, which creates a security exposure...
Ansible-core: exposure of sensitive information in ansible vault files due to improper logging
...
CVE-2025-7079 mao888 bluebell-plus JWT Token jwt.go hard-coded password
A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebellbackend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plu...
The Psychology of Exposure: Why Security Teams Ignore What’s Right in Front of Them
Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Your security team sees everything and notices nothing. Drowning in alerts, CVEs, dashboards, risk...
CVE-2024-24915 SmartConsole Sensitive Credential Exposure via Memory Dump
Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them...
Linux Crash Reporting Flaws (CVE-2025-5054, 4598) Expose Password Hashes
Qualys details CVE-2025-5054 and CVE-2025-4598, critical vulnerabilities affecting Linux crash reporting tools like Apport and systemd-coredump. Learn how…...
zot logs secrets
Summary When using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Details Container Image 15.04.2025: ghcr.io/project-zot/zot-linux-amd64:latest Here is an example how the configuration can look which causes the abov...
CVE-2020-13881
In support.c in pamtacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used...
CVE-2019-10329
Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
CVE-2025-2545
creationtimestamp| type| source ---|---|--- 2025-05-05 12:20:45+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14844 2025-05-05 15:52:37+00:00| seen| https://t.me/cvedetector/24450 2025-05-05 16:16:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3logrd7hbf72w...
CVE-2022-49838
In the Linux kernel, the following vulnerability has been resolved: sctp: clear outcurr if all frag chunks of current msg are pruned A crash was reported by Zhen Chen: listdel corruption, ffffa035ddf01c18-next is NULL WARNING: CPU: 1 PID: 250682 at lib/listdebug.c:49 listdelentryvalid+0x59/0xe0...
Transforming security with Microsoft Security Exposure Management initiatives
Just as nature sheds its winter coat, it's time to prune outdated security measures and plant the seeds of a more robust defense. For years, Microsoft Secure Score has served as a foundational tool for organizations to assess their security posture. By providing a numerical representation of...
GHSA-WXPC-2674-RXVW Feast Cross-Origin Resource Sharing vulnerability
A Cross-Origin Resource Sharing CORS vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security...
GitLab Public Snippets Detected
This is an informational notice that the scanner was able to detect public snippets on the target GitLab instance. No source data...
Linux Distros Unpatched Vulnerability : CVE-2021-32747
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables are exposed to...
Linux Distros Unpatched Vulnerability : CVE-2020-10134
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pairing in Bluetooth Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjacent access when the...
CVE-2025-1738 Multiple vulnerabilities in Trivision Camera NC227WF
A Password Transmitted over Query String vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity, exposing this sensitive information to a third party...
Spring LDAP Spring LDAP sensitive data exposure for case-sensitive comparisons
The usage of String.toLowerCase and String.toUpperCase has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820...
WordPress Elementor – Header, Footer & Blocks Template Plugin <= 1.6.43 is vulnerable to Sensitive Data Exposure
Software Elementor – Header, Footer & Blocks Template Type Plugin Vulnerable versions = 1.6.43 Fixed in 1.6.44 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-10050 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 22957639a0e5...