CVE-2025-0251

CVE-2025-0251 affects HCL IEM. The vulnerability is described as a concurrent login flaw where the application allows multiple concurrent sessions using the same user credentials, potentially exposing sensitive information. The NVD CVSS v3.1 vector indicates high confidentiality impact (C:H) with...

PT-2025-30714 · Hcl · Hcl Iem

Name of the Vulnerable Software and Affected Versions: HCL IEM affected versions not specified Description: The application allows multiple concurrent sessions using the same user credentials, potentially introducing security risks. Recommendations: At the moment, there is no information about a...

CVE-2025-6260

CVE-2025-6260 affects Network Thermostat X-Series WiFi Thermostats: the embedded web server can be reached unauthenticated over LAN or via Internet-exposed router, enabling an attacker to reset user credentials by manipulating the web interface. The exact vulnerable versions are not specified in ...

CVE-2025-6260 Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function

The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset us...

CVE-2025-54064

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. The common Rucio helm-charts for the rucio-server, rucio-ui, and rucio-webui define the log format for the apache access log of these components...

CVE-2025-54064

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. The common Rucio helm-charts for the rucio-server, rucio-ui, and rucio-webui define the log format for the apache access log of these components...

CVE-2025-54066 DiracX-Web login page has Open Redirect vulnerability

DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request that they can pass to redirect an authenticated user to another arbitrary website. In the login page, DiracX-Web has a redirect field which i...

PT-2025-29919 · Unknown +2 · Rucio-Webui +3

Name of the Vulnerable Software and Affected Versions: rucio-server versions 37.0.2, 35.0.1, and 32.0.1 rucio-ui versions 37.0.4, 35.0.1, and 32.0.2 rucio-webui versions 37.0.2, 35.1.1, and 32.0.1 Description: Rucio is a software framework used to organize, manage, and access large volumes of...

CVE-2024-38648

A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials...

CVE-2024-38648

A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials...

CVE-2024-38648

A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials...

CVE-2024-38648

Summary: CVE-2024-38648 is a vulnerability in Ivanti Desktop and Server Management (Ivanti DSM) prior to version 2024.2. It arises from a hardcoded secret that could allow an authenticated attacker on an adjacent network to decrypt sensitive data, including user credentials. Affected products/ver...

PT-2025-29292 · Ivanti · Ivanti Dsm

Name of the Vulnerable Software and Affected Versions: Ivanti DSM versions prior to 2024.2 Description: A hardcoded secret within the software allows an authenticated attacker on an adjacent network to decrypt sensitive data, including user credentials. Recommendations: Update Ivanti DSM to versi...

CVE-2025-36599

Dell PowerFlex Manager VM, versions prior to 4.6.2.1, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be...

CVE-2025-36599

Dell PowerFlex Manager VM, versions prior to 4.6.2.1, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be...

PT-2025-28957 · Dell · Dell Powerflex Manager

Name of the Vulnerable Software and Affected Versions: Dell PowerFlex Manager VM versions prior to 4.6.2.1 Description: Dell PowerFlex Manager VM is affected by an issue allowing the insertion of sensitive information into log files. A low-privileged attacker with remote access could exploit this...

CVE-2025-42979

The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attacker who gains access to the user hive o...

CVE-2025-42979 Insecure Key & Secret Management vulnerability in SAP GUI for Windows

The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attacker who gains access to the user hive o...

PT-2025-28294 · Guixt · Guixt

Name of the Vulnerable Software and Affected Versions: GuiXT affected versions not specified Description: The issue concerns the use of obfuscation algorithms instead of secure symmetric ciphers for storing RFC user credentials on the client PC. This leads to a high impact on confidentiality, as ...

CVE-2025-6814

The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportnow function in versions 1.0 to 1.1.2. This makes it possible for unauthenticated attackers to download all plugin data, including user accounts, user meta, and PayPal...