Cisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service Vulnerability

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a denial of service DoS condition in the Cisco AnyConnect service on an affected device. This vulnerability is due to...

CVE-2022-49952

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix memory corruption on probe Add the missing sanity check on the probed-session count to avoid corrupting memory beyond the fixed-size slab-allocated session array when there are more than FASTRPCMAXSESSIONS...

CVE-2025-49651

Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI...

CVE-2025-42996 Multiple vulnerabilities in SAP MDM Server

SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticate giving the ability to access or modify non-sensitive information or consume sufficient resources which could degrade the performance of the server causing...

GHSA-HXVR-GG2W-J48X BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform. NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from...

CVE-2025-49653

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform...

Improperly Implemented Security Check for Standard

Overview Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard due to the exposure of sensitive data in active sessions. An attacker can retrieve credentials for users on the management platform by exploiting this vulnerability. Note: The maintaine...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to improper security controls. An attacker can gain unauthorized access and control over active sessions by exploiting this security oversight. Note: The maintainers of BackendAI do not consider this report to...

CVE-2025-5880: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in Whistle 2.9.98 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/sessions/get-temp-file. The manipulation of the argument filename leads to path traversal. The exploit has been disclosed to the public and may be used. The...

PT-2025-24548

Name of the Vulnerable Software and Affected Versions Lablup's BackendAI affected versions not specified Description The issue allows attackers to expose sensitive data in active sessions, enabling them to retrieve credentials for users on the management platform. Recommendations At the moment,...

whistle 路径遍历漏洞

whistle is a Node-based implementation of a cross-platform packet-catching debugging tool by avenwu's individual developers. A path traversal vulnerability exists in whistle version 2.9.98 due to a path traversal error in the parameter filename in the file /cgi-bin/sessions/get-temp-file...

Lablup BackendAI 安全漏洞

Lablup BackendAI is a machine learning platform from Lablup Korea. A security vulnerability exists in Lablup BackendAI that stems from the exposure of sensitive data in active sessions, which could lead to an attacker gaining access to management platform user credentials...

DEBIAN-CVE-2025-0620

A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again...

CVE-2025-0620

A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again...

SUSE CVE-2025-0620

A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again...

BIT-JOOMLA-2024-21722 [20240201] - Core - Insufficient session expiration in MFA management views

The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...

Samba Missing Re-Authentication Vulnerability (CVE-2025-0620)

Samba is prone to a vulnerability when re-authenticating an expired SMB session. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2025-4986

A stored Cross-site Scripting XSS vulnerability affecting Model Definition in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session...

CVE-2025-1484

A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker could impact the confidentiality or integrity of the system. An attacker can use this vulnerability to construct a request that will cause JavaScript code supplied ...

CVE-2025-1484

CVE-2025-1484 affects the Hitachi Asset Suite media upload component. If exploited, an attacker can craft a request that causes attacker-supplied JavaScript to execute in the victim’s browser within the application session, impacting confidentiality and integrity. Connected sources (Red Hat, NVD,...