10712 matches found
Over 80,000 Microsoft Entra ID Accounts Targeted Using Open-Source TeamFiltration Tool
Cybersecurity researchers have uncovered a new account takeover ATO campaign that leverages an open-source penetration testing framework called TeamFiltration to breach Microsoft Entra ID formerly Azure Active Directory user accounts. The activity, codenamed UNKSneakyStrike by Proofpoint, has...
CVE-2025-49651
Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI...
CVE-2025-4573 LDAP Injection in Mattermost Enterprise Edition When Using Active Directory
Mattermost versions 10.7.x = 10.7.1, 10.6.x = 10.6.3, 10.5.x = 10.5.4, 9.11.x = 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT...
CVE-2025-4573
Mattermost LDAP issue (CVE-2025-4573): 10.5.x–10.7.x and 9.11.x up to 9.11.13 fail to validate LDAP group ID attributes. An authenticated administrator with PermissionSysconsoleWriteUserManagementGroups can trigger LDAP search filter injection via PUT /api/v4/ldap/groups/{remote_id}/link when obj...
CVE-2025-4573 LDAP Injection in Mattermost Enterprise Edition When Using Active Directory
Mattermost versions 10.7.x = 10.7.1, 10.6.x = 10.6.3, 10.5.x = 10.5.4, 9.11.x = 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT...
The vulnerability of the Service Account Auditing service of the Windows Active Directory management and reporting software Zoho ManageEngine ADAudit Plus allows a perpetrator to execute arbitrary code.
The vulnerability of the Service Account Auditing service in the Windows Active Directory management and reporting software Zoho ManageEngine ADAudit Plus is related to the lack of security measures for the SQL query structure. Exploitation of this vulnerability could allow a malicious actor to...
CVE-2025-41657
Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by an unauthenticated adjacent attacker...
CISA Adds Erlang SSH and Roundcube Flaws to Known Exploited Vulnerabilities Catalog
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added two critical security flaws impacting Erlang/Open Telecom Platform OTP SSH and Roundcube to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The vulnerabilities in question are...
GHSA-HXVR-GG2W-J48X BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform. NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from...
CVE-2025-49653
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform...
Improperly Implemented Security Check for Standard
Overview Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard due to the exposure of sensitive data in active sessions. An attacker can retrieve credentials for users on the management platform by exploiting this vulnerability. Note: The maintaine...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization due to improper security controls. An attacker can gain unauthorized access and control over active sessions by exploiting this security oversight. Note: The maintainers of BackendAI do not consider this report to...
CVE-2025-49653 Exposure of sensitive Information allows account takeover
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform...
PT-2025-24548
Name of the Vulnerable Software and Affected Versions Lablup's BackendAI affected versions not specified Description The issue allows attackers to expose sensitive data in active sessions, enabling them to retrieve credentials for users on the management platform. Recommendations At the moment,...
Could not apply snapshot: Device has active dirty bitmaps
Challenge When the user attempts to use the Rollback function for a snapshot on a Proxmox Virtual Environment PVE Virtual Machine VM that is protected by Veeam Backup & Replication, the following error occurs: qemu-img: Could not apply snapshot '%%': Device has active dirty bitmaps Cause This err...
Fedora 42 : krb5 (2025-3de9fe91ff)
The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-3de9fe91ff advisory. Disallowing use of the arcfour-hmac-md5 encryption type for session keys Add support for the PKINIT paChecksum2 sequence, required for Active Directory...
emlog 代码注入漏洞
emlog is emlog open source PHP and MySQL based on a set of CMS site building system . emlog 2.5.7 and previous versions of the code injection vulnerability , the vulnerability stems from the file /admin/article.php parameter activepost in the wrong operation leads to cross-site scripting...
Lablup BackendAI 安全漏洞
Lablup BackendAI is a machine learning platform from Lablup Korea. A security vulnerability exists in Lablup BackendAI that stems from the exposure of sensitive data in active sessions, which could lead to an attacker gaining access to management platform user credentials...
MAL-2025-4764 Malicious code in sechub-web-ui (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f65f37c0cf500f985994b4ab4d2cc764e8072e70cc17aab91987e239129fa93 Any computer that has this package installed or running should be considered...