XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

Impact The PDF export uses a background job that runs on the server-side. Jobs like this have a status that is serialized in the permanent directory when the job is finished. The job status includes the job request. The PDF export job request is initialized, before the job starts, with some conte...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform versions prior to 16.4.8 and 17.4.0-rc-1, which stems from the unencrypted storage of sensitive cookies in PDF export jobs...

Linux Distros Unpatched Vulnerability : CVE-2022-2582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintex...

CVE-2025-0079

In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-0079

In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-0079

CVE-2025-0079 describes a logic error in Android's Bluetooth stack (avdtp/avctp) that could allow unencrypted channels, enabling local privilege escalation with user privileges required and no user interaction. Connected documents indicate this is addressed in the Android security bulletin for 20...

CVE-2025-0079

In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-0079

In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

New Sni5Gect Attack Crashes Phones and Downgrades 5G to 4G without Rogue Base Station

A team of academics has devised a novel attack that can be used to downgrade a 5G connection to a lower generation without relying on a rogue base station gNB. The attack, per the ASSET Automated Systems SEcuriTy Research Group at the Singapore University of Technology and Design SUTD, relies on ...

Linux Distros Unpatched Vulnerability : CVE-2016-2166

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The 1 proton.reactor.Connector, 2 proton.reactor.Container, and 3 proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an...

Linux Distros Unpatched Vulnerability : CVE-2016-2141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw t...

Linux Distros Unpatched Vulnerability : CVE-2010-2087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Oracle Mojarra 1.214 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view...

Linux Distros Unpatched Vulnerability : CVE-2025-54799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Let's Encrypt client and ACME library written in Go Lego. In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package thus the lego library an...

Linux Distros Unpatched Vulnerability : CVE-2025-55014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dict.youdao.com and...

PT-2025-34192 · Undefined · Undefined

New vulnerabilities in Workhorse Software threaten sensitive data in cities and towns across Wisconsin. Key Points: - Two serious vulnerabilities discovered in Workhorse Software's accounting application. - Vulnerabilities expose sensitive personally identifiable information PII stored in the...

PT-2025-34193 · Undefined · Undefined

New vulnerabilities in Workhorse Software threaten sensitive data in cities and towns across Wisconsin. Key Points: - Two serious vulnerabilities discovered in Workhorse Software's accounting application. - Vulnerabilities expose sensitive personally identifiable information PII stored in the...

Linux Distros Unpatched Vulnerability : CVE-2024-34083

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted comman...

CVE-2025-54156

The Sante PACS Server Web Portal sends credential information without encryption...

Tenda AC6 V5.0 web portal authentication unencrypted transmission of credentials vulnerability

Talos Vulnerability Report TALOS-2025-2162 Tenda AC6 V5.0 web portal authentication unencrypted transmission of credentials vulnerability August 20, 2025 CVE Number CVE-2025-27564 SUMMARY A unencrypted transmission of credentials vulnerability exists in the web portal authentication functionality...

Tenda AC6 V5.0 Session Authentication Cookie unencrypted transmission of credentials vulnerability

Talos Vulnerability Report TALOS-2025-2167 Tenda AC6 V5.0 Session Authentication Cookie unencrypted transmission of credentials vulnerability August 20, 2025 CVE Number CVE-2025-31646 SUMMARY A unencrypted transmission of credentials vulnerability exists in the Session Authentication Cookie...