CVE-2025-58445

CVE-2025-58445 concerns the Atlantis self-hosted Go application. The connected document GO-2025-3940 describes Atlantis exposing the service version publicly via the "/status" API endpoint in github.com/runatlantis/atlantis. The Initial document states that this information disclosure could allow...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /status endpoint, which returns detailed version and build information. An attacker can gain insights into the software version and configuration by sending unauthenticated requests to this endpoint and...

Atlantis Exposes Service Version Publicly on /status API Endpoint

Summary Atlantis publicly exposes detailed version information on its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. Details The /statu...

GHSA-XH7V-965R-23F7 Atlantis Exposes Service Version Publicly on /status API Endpoint

Summary Atlantis publicly exposes detailed version information on its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. Details The /statu...

PT-2025-36640

Summary Atlantis publicly exposes detailed version information on its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. Details The /statu...

PT-2025-36399

Name of the Vulnerable Software and Affected Versions Atlantis affected versions not specified Description Atlantis, a self-hosted golang application that listens for Terraform pull request events via webhooks, exposes detailed version information through the /status endpoint. This information...

usb: net: sierra: check for no status endpoint

...

SUSE CVE-2025-38474

In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission...

AZL-65952 CVE-2025-38474 affecting package kernel for versions less than 6.6.104.2-1

In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission...

AZL-72974 CVE-2025-38474 affecting package kernel for versions less than 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission...

CVE-2025-38474 usb: net: sierra: check for no status endpoint

In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission...

CVE-2022-44348

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/updatestatus.php?id=...

CVE-2025-21626 GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint

GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the status.php endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the status.p...

GLPI 信息泄露漏洞

GLPI is an open source IT and asset management software from GLPI Open Source. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

PT-2024-27088

Name of the Vulnerable Software and Affected Versions Aegon Life version 1.0 Description The issue is a SQL injection vulnerability. It can be exploited via the client id parameter at the "clientStatus.php" endpoint. Recommendations For Aegon Life version 1.0, as a temporary workaround, consider...

pixiv: Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}

The server-status endpoint was accessible, allowing access to internal logs and information...

CVE-2023-48020

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/task/changeStatus...

CVE-2023-28442 Geoserver for GeoNode sensitive information leak

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.6, 2.19.6, and 2.18.7, anonymous users can obtain sensitive information about GeoNode configurations from the response of the /geoserver/rest/about/status...

CVE-2023-1564

A vulnerability was found in SourceCodester Air Cargo Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/transactions/updatestatus.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql...

Sanitization Management System SQL注入漏洞

Sanitization Management System is a sanitization management system by Carlo Montero Personal Developer. A SQL injection vulnerability exists in Sanitization Management System v1.0. An attacker can exploit this vulnerability by performing a SQL injection attack via...