CVE-2025-41421

CVE-2025-41421 describes a privilege-escalation flaw in TeamViewer components due to improper handling of symbolic links. A local, unprivileged attacker on Windows can spoof the update file path in TeamViewer Full Client, TeamViewer Host, and, per related sources, TeamViewer Remote and Tensor, fo...

IBM Transformation Extender Advanced 日志信息泄露漏洞

IBM Transformation Extender Advanced is a data transformation, validation and standardization tool software from International Business Machines IBM. IBM Transformation Extender Advanced suffers from a log information disclosure vulnerability that originates from storing sensitive information in ...

WP < 6.8.3 - Contributor+ Sensitive Data Disclosure

Description WordPress is affected by a data exposure issue which could allow contributor and above roles to access some restricted content...

PT-2025-40247

Name of the Vulnerable Software and Affected Versions IBM Transformation Extender Advanced version 10.0.1 Description IBM Transformation Extender Advanced version 10.0.1 stores potentially sensitive information in log files. A local user could read this information. Recommendations At the moment,...

Splunk Cloud Platform和Splunk Enterprise 访问控制错误漏洞

Splunk Cloud Platform and Splunk Enterprise are both products of Splunk Corporation, U.S.A. Splunk Cloud Platform is a powerful data collection, processing, and analytics service.Splunk Enterprise is a suite of data collection and analytics software. An access control error vulnerability exists i...

ROS-20251001-08

Vulnerability of cJSON parser is related to boundary conditions in decodearrayindexfrompointer function in cJSONUtils.c. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to potentially sensitive information...

WordPress File Manager, Code editor, backup by Managefy plugin <= 1.6.1 - Unauthenticated Information Exposure vulnerability

Unauthenticated Information Exposure vulnerability discovered by Aurélien BOURDOIS Elymaro in WordPress Plugin File Manager, Code Editor, and Backup by Managefy versions = 1.6.1...

CVE-2025-7493 Freeipa: idm: privilege escalation from host to domain admin in freeipa

A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA...

WordPress Download Manager plugin <= 3.3.32 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin Download Manager versions = 3.3.32...

CVE-2025-59952

MinIO Java SDK is a Simple Storage Service aka S3 client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically...

PT-2025-40023

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Local versions 2.0.0 through 2.0.106 IBM Planning Analytics Local versions 2.1.0 through 2.1.13 Description A malicious privileged user may be able to bypass the user interface to obtain unauthorized access to sensitive...

MinIO Java SDK 代码注入漏洞

MinIO Java SDK is an open source developer tool for MinIO Client for Java by MinIO. A code injection vulnerability exists in versions of MinIO Java SDK prior to 8.6.0, which stems from the automatic substitution of XML tagged values for system properties or environment variables, which could lead...

PT-2025-40011

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift AI versions 2.19 through 2.21 Description A critical flaw exists in Red Hat OpenShift AI Service that allows a low-privileged authenticated user, such as a data scientist using a Jupyter notebook, to escalate their privileges...

CVE-2025-59956 AgentAPI exposed user chat history via a DNS rebinding attack

AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain access to the /messages endpoint served by the Agent API. This allows for th...

CVE-2025-59952 minio-java Client XML Tag is Vulnerable to Value Substitution

MinIO Java SDK is a Simple Storage Service aka S3 client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically...

DNS Rebinding

Overview Affected versions of this package are vulnerable to DNS Rebinding when hosted over plain HTTP on localhost. An attacker can access sensitive user data and chat history via the /messages endpoint that may include secret keys, file system contents, and intellectual property by enticing the...

XML Injection

Overview Affected versions of this package are vulnerable to XML Injection when processing XML data with tags containing references to system properties or environment variables. An attacker can access sensitive information, such as credentials, file paths, or system configuration details, by...

IBM Watsonx.data Log Information Disclosure Vulnerability

IBM Watsonx.data is an open data lake warehouse platform from International Business Machines IBM. IBM Watsonx.data suffers from a log information disclosure vulnerability that stems from storing potentially sensitive information in log files, which can be exploited by an attacker to cause it to ...

WordPress Plugin Permalink Manager Lite Information Disclosure Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in the WordPress plugin Permalink Manager Lite.T...

Adminer Server-Side Request Forgery Vulnerability

Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information...