4074 matches found
The vulnerability of the AWS VPN Client’s secure tunneling application arises from incorrect handling of the link before accessing a file. This allows attackers to execute arbitrary code.
The vulnerability of the AWS VPN Client’s secure tunneling application is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability could allow a attacker to execute arbitrary code...
Security Bulletin: Due to use of netty-codec, IBM Sterling Connect:Direct Web Services is affected by denial of service.
Summary Netty-codec is used by IBM Sterling Connect:Direct Web Services CVE-2025-58057. Vulnerability Details CVEID:CVE-2025-58057 DESCRIPTION: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In...
CVE-2025-62647
The Restaurant Brands International RBI assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be used to call an API to return a signed AWS upload URL, for any store's path...
Restaurant Brands International assistant platform 安全漏洞
Restaurant Brands International assistant platform is a restaurant back office platform from Restaurant Brands International. A security vulnerability exists in Restaurant Brands International assistant platform version 2025-09-06 and earlier, which stems from returning JWTs that can be used to...
VulnCheck KEV: CVE-2023-34124
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions...
CVE-2025-9152 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration DCR endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges,...
CVE-2025-10611 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaini...
Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by a vulnerability in commons-lang3-3.17.0.jar (CVE-2025-48924)
Summary IBM Sterling Connect:Direct Web Services is affected by an uncontrolled recursion vulnerability in commons-lang3-3.17.0. This has been addressed in new fixpacks available from Fix Central. Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apac...
CVE-2025-62375
The CVE describes an improper verification in the AWS attestor used by go-witness and witness. In affected versions, the attestor can accept forged AWS EC2 instance identity documents when a signature is absent/empty or RSA verification fails, and it relies on a legacy global AWS certificate inst...
CVE-2025-62375 go-witness Improper Verification of AWS EC2 Identity Documents
go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is...
go-witness 信任管理问题漏洞
go-witness is a Golang library open-sourced by in-toto. A trust management issue vulnerability exists in go-witness version 0.8.6 and earlier, which stems from the AWS attestor not properly validating AWS EC2 instance identity documents, which could lead to the acceptance of forged identity...
PT-2025-42399
Name of the Vulnerable Software and Affected Versions go-witness versions 0.8.6 and earlier witness versions 0.9.2 and earlier Description The AWS attestor in go-witness and witness improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is n...
AWS VDP: Responsible disclosure - public S3 bucket exposing JSON/config files
A publicly listable S3 bucket was discovered, exposing various JSON and configuration files. The bucket listing and file metadata were retrievable without authentication...
CVE-2025-23137 vulnerabilities
Vulnerabilities for packages: linux-azure, linux-gcp, linux-qemu, linux-vmware, linux-aws...
Crimson Collective: A New Threat Group Observed Operating in the Cloud
Introduction Over the past few weeks, Rapid7 has observed increased activity of a new threat group attacking AWS cloud environments with the goal of data exfiltration and subsequent extortion of the victim. This threat group refers to itself as ‘Crimson Collective’ and has recently announced that...
Security Bulletin: IBM Sterling Connect:Direct Web Services vulnerable to spring-beans-6.2.3.jar (CVE-2025-41242)
Summary IBM Sterling Connect:Direct Web Services is vulnerable toPath Traversal Vulnerability in spring-beans-6.2.3. This has been addressed in new fixpacks available from Fix Central. Vulnerability Details CVEID:CVE-2025-41242 DESCRIPTION: Spring Framework MVC applications can be vulnerable to a...
Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by a vulnerability in spring-security-core-6.4.3.jar (CVE-2025-41248)
Summary IBM Sterling Connect:Direct Web Services is vulnerable to Annotation detection mechanism may not correctly resolve annotations on methods in spring-security-core-6.4.3. This has been addressed in new fixpacks available from Fix Central. Vulnerability Details CVEID:CVE-2025-41248...
Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by a vulnerability in spring-core-6.2.3.jar (CVE-2025-41249)
Summary IBM Sterling Connect:Direct Web Services is vulnerable to Annotation detection mechanism may not correctly resolve annotations on methods in spring-core-6.2.3. This has been addressed in new fixpacks available from Fix Central. Vulnerability Details CVEID:CVE-2025-41249 DESCRIPTION: The...
Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by a vulnerability in spring-web-6.2.3.jar(CVE-2025-41234)
Summary IBM Sterling Connect:Direct Web Services is vulnerable to a reflected file download RFD attack in spring-web-6.2.3. This has been addressed in new fixpacks available from Fix Central. Vulnerability Details CVEID:CVE-2025-41234 DESCRIPTION: Description In Spring Framework, versions 6.0.x a...
