EUVD-2025-202458

Jenkins's build authorization token is stored and displayed in plain text...

CVE-2025-67638

CVE-2025-67638 affects Jenkins 2.540 and earlier, LTS 2.528.2 and earlier. The root cause is that build authorization tokens shown on the job configuration form are not masked, allowing potential observation or capture by an attacker. The CVE is documented in Jenkins security advisory SECURITY-78...

CVE-2025-65830

CVE-2025-65830 describes a vulnerability in the Meatmeet Pro App where missing certificate validation enables a man-in-the-middle attack on TLS traffic. Upstream attackers could decrypt, inspect, and modify requests, potentially leading to full account compromise if active authentication tokens a...

CVE-2025-65830

Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt the TLS traffic, inspect its contents, and modify the requests in transit. This may result in a total compromise of the user's account if t...

PT-2025-50356

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.540 and earlier Jenkins LTS versions 2.528.2 and earlier Description Jenkins does not mask build authorization tokens displayed on the job configuration form, potentially allowing attackers to observe and capture them...

Jenkins 安全漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A security vulnerability exists in Jenkins 2.540 and earlier and LTS 2.528.2 and earlier, which stems from an unmasked bui...

Jenkins 安全漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A security vulnerability exists in Jenkins 2.540 and earlier and LTS 2.528.2 and earlier, which stems from unencrypted...

Jenkins LTS < 2.528.3 / Jenkins weekly < 2.541 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.528.3 or Jenkins weekly prior to 2.541. It is, therefore, affected by multiple vulnerabilities: - A cross-site request forgery CSRF vulnerability in Jenkins 2.540 a...

Insertion of sensitive information into REST API logs

...

GO-2025-4197 Mattermost Server exposes OAuth personal access tokens to attackers in github.com/mattermost/mattermost-server

Mattermost Server exposes OAuth personal access tokens to attackers in github.com/mattermost/mattermost-server...

Linux Distros Unpatched Vulnerability : CVE-2025-59303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update...

Vulnerabilities fixed in GitLab

GitLab has fixed vulnerabilities in its Community Edition CE and Enterprise Edition EE versions. The vulnerabilities include the ability for unauthenticated users to cause Denial of Service DoS conditions by submitting malicious JSON requests. In addition, unauthenticated users could join arbitra...

EUVD-2025-199761

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions...

CVE-2025-13611

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions...

CVE-2025-13611

GitLab CVE-2025-13611 affects GitLab CE/EE versions 13.2 to 18.4.5, 18.5 to 18.5.3, and 18.6 to 18.6.1. An authenticated user with access to certain logs could obtain sensitive tokens under specific conditions. The issue has been remediated by patches in GitLab, with fixed releases noted as 18.6....

CVE-2025-65957

Core Bot (open-source Discord bot for maple hospital servers) contained an information-disclosure vulnerability prior to commit dffe050, where API keys (SUPABASE_API_KEY, TOKEN) loaded from environment variables could be exposed in configuration summaries, logs, or embeds due to incomplete redact...

MAL-2025-191139 Malicious code in pergeltest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30c58cbe926b3e974924e37d17a2a498b8c47ee601e0bdf781d3bd385d27779b The package pergeltest was found to contain malicious code. Source: ghsa-malware 5ffcb1d48425e2a6a81862b0d4f1bd3eaddef69103c0d9949ddbf2d359d2d1f1 Any...

BIT-GITLAB-2025-11990 Improper Handling of URL Encoding (Hex Encoding) in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses...

JetBrains YouTrack < 2025.3.104432 Multiple Vulnerabilities

The version of JetBrains YouTrack installed on the remote host is prior to 2025.2.92387. It is, therefore, affected by multiple vulnerabilities as referenced in the advisory. - In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure. CVE-2025-64685 - ...

CVE-2025-64706 Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure

Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference IDOR vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing th...