EUVD-2025-197856

reebox v5 HD firmware = 1.7.20, Freebox v5 Crystal firmware = 1.7.20, Freebox v6 Révolution r1–r3 firmware = 4.7.x, Freebox Mini 4K firmware = 4.7.x, and Freebox One firmware = 4.7.x were discovered to expose subscribers' IMSI identifiers in plaintext during the initial phase of EAP-SIM...

OSV-2025-901 Heap-use-after-free in apache::thrift::protocol::TCompactProtocolT<apache::thrift::transport::TMemoryBu

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=461058054 Crash type: Heap-use-after-free READ 1 Crash state: apache::thrift::protocol::TCompactProtocolTapache::thrift::transport::TMemoryBu unsigned int parquet::format::OffsetIndex::readapache::thrift::protocol::TCompa void...

CVE-2025-63292

Several Freebox products, including Freebox v5 HD (firmware 1.7.20), Freebox v5 Crystal (firmware 1.7.20), Freebox v6 Révolution r1–r3 (firmware 4.7.x), Freebox Mini 4K (firmware 4.7.x), and Freebox One (firmware 4.7.x), are vulnerable to the cleartext transmission of sensitive information. Durin...

The vulnerability of the endpoint of the Nagios Log Server software monitoring and analysis tool allows a malicious actor to extract administrative API keys in an unencrypted form.

The vulnerability of the final endpoint of the Nagios Log Server monitoring and analysis software relates to the disclosure of system data that is not authorized for the controlled area. Exploiting this vulnerability allows a malicious actor to extract administrative API keys in an unencrypted fo...

The vulnerability of the Prisma Browser, related to the unencrypted storage of confidential information, allows attackers to gain unauthorized access to protected data.

The vulnerability of the Prisma Browser is related to the unencrypted storage of confidential information. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the ZenCount visitor counter lies in the unencrypted storage of critical information, allowing attackers to compromise the confidentiality of the protected data.

The vulnerability of the ZenCount visitor counter is related to the unencrypted storage of critical information. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality of the protected information...

CVE-2016-15056

Ubee EVW3226 cable modem/routers firmware versions up to and including 1.0.20 store configuration backup files in the web root after they are generated for download. These backup files remain accessible without authentication until the next reboot. A remote attacker on the local network can reque...

EUVD-2016-10800

Ubee EVW3226 cable modem/routers firmware versions up to and including 1.0.20 store configuration backup files in the web root after they are generated for download. These backup files remain accessible without authentication until the next reboot. A remote attacker on the local network can reque...

Ubee EVW3226 安全漏洞

The Ubee EVW3226 is a WiFi router from Ubee Corporation of Taiwan, China. A security vulnerability exists in the Ubee EVW3226 version 1.0.20 and earlier, which stems from a configuration backup file being stored in the web root directory and unencrypted, which could lead to the disclosure of...

CVE-2016-15056: Insertion of Sensitive Information into Externally-Accessible File or Directory

Ubee EVW3226 cable modem/routers firmware versions up to and including 1.0.20 store configuration backup files in the web root after they are generated for download. These backup files remain accessible without authentication until the next reboot. A remote attacker on the local network can reque...

SUSE CVE-2025-58356

Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function cryptactivatebypasshrase. If the VM is successful in opening the partition with th...

CVE-2025-64143

Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system...

The vulnerability of the Delegated License Service (DLS) component of NVIDIA’s licensing system allows a perpetrator to disclose protected information.

The vulnerability of the Delegated License Service DLS component of NVIDIA’s licensing system lies in the unencrypted storage of critical information. Exploiting this vulnerability could allow a malicious actor to disclose the protected data remotely...

CVE-2025-12508

When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data and compromise confidentiality...

CVE-2025-34271

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network...

EUVD-2025-37365

When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data and compromise confidentiality...

CVE-2025-12508

When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data and compromise confidentiality...

CVE-2025-12508

CVE-2025-12508 affects BRAIN2: when domain users act as BRAIN2 users, communication with Active Directory services is unencrypted, risking interception of authentication data and confidentiality. Documents consistently identify BRAIN2 as the affected software and describe the unencrypted AD traff...

CVE-2025-12508 Unencrypted communication to Active Directory services

When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data and compromise confidentiality...

CVE-2025-12508 Unencrypted communication to Active Directory services

When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data and compromise confidentiality...