15228 matches found
PT-2025-30700 · Hcl · Hcl Iautomate
Name of the Vulnerable Software and Affected Versions: HCL iAutomate affected versions not specified Description: HCL iAutomate is affected by insufficient session expiration. This allows session tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized...
CVE-2025-4570
An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information...
CVE-2025-51471
Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the server.auth.URL function. An attacker can obtain authentication tokens and circumvent access controls by supplying a crafted realm value in the WWW-Authenticate header returned from the /api/pull endpoint...
CVE-2025-51864
A reflected cross-site scripting XSS vulnerability exists in AIBOX LLM chat chat.aibox365.cn through 2025-05-27, allowing attackers to hijack accounts through stolen JWT tokens...
PT-2025-30422 · Aibox Llm · Aibox Llm
Name of the Vulnerable Software and Affected Versions: AIBOX LLM chat versions through 2025-05-27 Description: A reflected cross-site scripting XSS issue exists, potentially allowing attackers to hijack accounts through stolen JWT tokens. Recommendations: At the moment, there is no information...
CVE-2025-51471
Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint...
CVE-2025-51864
Summary: CVE-2025-51864 is a reflected XSS vulnerability in the AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27 that could enable JWT token theft and remote account hijack via crafted input. What is affected: AIBOX LLM chat front-end component used for chat interactions. Root cause / impact:...
CVE-2025-51864
A reflected cross-site scripting XSS vulnerability exists in AIBOX LLM chat chat.aibox365.cn through 2025-05-27, allowing attackers to hijack accounts through stolen JWT tokens...
CVE-2025-51864
A reflected cross-site scripting XSS vulnerability exists in AIBOX LLM chat chat.aibox365.cn through 2025-05-27, allowing attackers to hijack accounts through stolen JWT tokens...
CVE-2025-51860
TelegAI (telegai.com) is affected by a Stored XSS (CVE-2025-51860) in its chat component and character container. The vulnerability allows an attacker to craft an AI Character with SVG XSS payloads in fields such as description, greeting, example dialog, or system prompt, causing arbitrary client...
CVE-2025-51471
CVE-2025-51471 affects Ollama up to 0.6.7, with Cross-Domain Token Exposure via server.auth.getAuthorizationToken. A malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint can cause Ollama to send its authentication token to an attacker-controlled domain, bypassing ...
PT-2025-30449
Name of the Vulnerable Software and Affected Versions Ollama version 0.6.7 Description A cross-domain token exposure exists in the server.auth.getAuthorizationToken function. This allows remote attackers to steal authentication tokens and bypass access controls by exploiting a malicious realm val...
CVE-2025-51471
Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint...
CVE-2025-4570
An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information...
CVE-2025-4570
An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information...
📄 Intelbras RX 1500 2.2.9 / RX 3000 1.0.11 IDOR / XSS
Intelbras routers RX 1500 version 2.2.9 and RX 3000 version 1.0.11 suffer from multiple cross site scripting and insecure direct object reference vulnerabilities. =====Tempest Security Intelligence========================================== Multiple vulnerabilities in the web management interface ...
PT-2025-30246 · Asus · Myasus
Name of the Vulnerable Software and Affected Versions: MyASUS affected versions not specified Description: An issue involving insecure storage of sensitive keys was identified in MyASUS. This could potentially allow an unauthorized actor to obtain a token used for communication with certain...
CVE-2025-6391
Brocade ASCG before 3.3.0 logs JSON Web Tokens JWT in log files. An attacker with access to the log files can withdraw the unencrypted tokens with security implications, such as unauthorized access, session hijacking, and information disclosure...
