Nexus Repository Anonymous Access

Nexus Repository Manager is a popular repository management tool used to store and manage software artifacts. If anonymous access is enabled, unauthenticated users can list and browse repositories, potentially exposing private artifacts such as source code, packages, and Docker images. No source...

BIT-GITEA-2025-68945

In Gitea before 1.21.2, an anonymous user can visit a private user's project...

Missing Authorization

Overview galaxy-web-apps is a Galaxy web apps Affected versions of this package are vulnerable to Missing Authorization in the create function in visualizations.py.An anonymous user can create visualizations. Remediation Upgrade galaxy-web-apps to version 25.1.dev0 or higher. References - GitHub...

GO-2025-4262 Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

Gitea: anonymous user can visit private user's project in code.gitea.io/gitea...

CVE-2025-68945

A flaw was found in Gitea. An anonymous user can exploit this vulnerability by visiting a private user's project, leading to unauthorized information disclosure. This allows an attacker to view details of projects that should remain private. Mitigation Mitigation for this issue is either not...

Gitea: anonymous user can visit private user's project

In Gitea before 1.21.2, an anonymous user can visit a private user's project...

CVE-2025-68945

In Gitea before 1.21.2, an anonymous user can visit a private user's project...

CVE-2025-68945

In Gitea before 1.21.2, an anonymous user can visit a private user's project...

EUVD-2025-205424

In Gitea before 1.21.2, an anonymous user can visit a private user's project...

CVE-2025-68945

The CVE-2025-68945 issue affects Gitea prior to 1.21.2, where an anonymous user could visit a private user’s project, potentially exposing project details. Connected advisories (OSV entries and vendor/go-sources) confirm the vulnerability in Gitea’s routing layers (e.g., routers/api/v1 and router...

CVE-2025-68945

In Gitea before 1.21.2, an anonymous user can visit a private user's project...

PT-2025-53447

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.21.2 Description An anonymous user can access a private user's project. Recommendations Update to version 1.21.2 or later...

Gitea 安全漏洞

Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in Gitea versions prior to 1.21.2, which stems from an anonymous user being able to access private user projects...

CVE-2025-63387

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous...

CVE-2025-63387

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous...

BIT-ACTIVEMQ-2021-26117 ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error...

TencentOS Server 3: grafana (TSSA-2025:0458)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0458 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

PT-2025-46236

Name of the Vulnerable Software and Affected Versions SAP Business One versions affected versions not specified Description An information disclosure issue exists in the anonymous API provided by SAP Business One Service Layer Directory SLD. An attacker with normal user access may be able to obta...

EUVD-2025-37512

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authenticated or anonymous WebDAV endpoints...

CVE-2025-10348

URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a malicious payload, which will be executed when a victim visits the URL of the uploaded resource. The resource is available to anyone without...