29540 matches found
CVE-2025-34064
A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket onelogin-adc-logs-production without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. The...
CVE-2025-34052
Rejected reason: An unauthenticated endpoint that exposes firmware version, MAC address, and supported codecs is not indicative of a security boundary being crossed, as this metadata is not inherently sensitive and commonly used for legitimate fingerprinting and discovery...
microcode_ctl: Exposure of sensitive information
Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel AtomR processors may allow an authenticated user to potentially enable information disclosure via local access...
microcode_ctl: Exposure of sensitive information
Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some IntelR Core™ processors 10th Generation may allow an authenticated user to potentially enable information disclosure via local access...
CVE-2025-34064 OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage
A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket onelogin-adc-logs-production without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. The...
CVE-2025-34064 OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage
A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket onelogin-adc-logs-production without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. The...
CVE-2025-34064
OneLogin AD Connector is affected by a cloud infrastructure misconfiguration that sends log data to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers an unclaimed bucket can receive log files from other tenants, potentially exposin...
CVE-2025-34051 AVTECH DVR Devices Server-Side Request Forgery
A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgiquery endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests...
CVE-2025-34051
CVE-2025-34051 describes a server-side request forgery in AVTECH DVR devices. The unauthenticated vulnerability targets /cgi-bin/nobody/Search.cgi?action=cgi_query and lets an attacker supply ip, port, and queryb64str to force the DVR to perform arbitrary HTTP requests, potentially leaking data o...
CVE-2025-34051 AVTECH DVR Devices Server-Side Request Forgery
A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgiquery endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests...
microcode_ctl: Exposure of sensitive information
Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect branch predictors for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...
CVE-2025-5967
A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan Name field, resulting in the exposure of sensitive data...
CVE-2025-5967
A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan Name field, resulting in the exposure of sensitive data...
CVE-2025-5967
CVE-2025-5967 is a stored cross-site scripting vulnerability in Trellix ENS HX 10.0.4. The issue allows an attacker to inject arbitrary HTML into the Malware Scan Name field, which can lead to exposure of sensitive data. Affected product is Trellix Endpoint Security HX, version 10.0.4; the root c...
CVE-2025-5967
A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan Name field, resulting in the exposure of sensitive data...
TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability
TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dum...
PT-2025-27568 · Iitb Sso · Iitb Sso
Name of the Vulnerable Software and Affected Versions: IITB SSO version 1.1.0 Description: The issue is related to misconfigured settings, allowing attackers to access sensitive application data. Recommendations: For IITB SSO version 1.1.0, reconfigure the settings to prevent unauthorized access ...
PT-2025-27552 · Onelogin · Onelogin Ad Connector
Name of the Vulnerable Software and Affected Versions: OneLogin AD Connector affected versions not specified Description: A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket onelogin-adc-logs-production without validating bucket...
PT-2025-27566 · Unknown · Conprosys Hmi System
Name of the Vulnerable Software and Affected Versions: CONPROSYS HMI System CHS versions prior to 3.7.7 Description: The issue concerns the exposure of a PHP phpinfo debug page to unauthenticated users, potentially containing sensitive data useful for an attacker. Recommendations: For versions...