496 matches found
F5 BIG-IP Next Central Manager 输入验证错误漏洞
F5 BIG-IP Next Central Manager is a centralized console from F5 USA. An input validation error vulnerability exists in F5 BIG-IP Next Central Manager, which stems from mishandling of API requests, and can be exploited by an attacker to cause termination of the Kubernetes service via an undisclose...
BIT-GITLAB-2025-0194 Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner...
CVE-2025-0194
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner...
CVE-2025-0194 Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner...
CVE-2025-0194 Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner...
CVE-2025-0194 Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner...
CVE-2025-0194
Removed by vendor...
CVE-2025-0194
CVE-2025-0194 (GitLab CE/EE) affects GitLab releases with logged access tokens during API requests under certain conditions. Affected versions are: 17.4 up to but not including 17.5.5; 17.6 up to 17.6.3; and 17.7 up to 17.7.1. The issue is mitigated by upgrading to the patched releases: 17.5.5 or...
WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service
Summary A Denial of Service DoS vulnerability in the authentication middleware allows any client to cause memory exhaustion by sending large request bodies. The server reads the entire request body into memory without size limits, creating multiple copies during processing, which can lead to Out ...
PT-2024-40073 · Apache +1 · Apache +1
Name of the Vulnerable Software and Affected Versions: ibexa post-install versions prior to the patched versions Description: The issue is related to the BREACH vulnerability, which affects HTTP compression and can allow secrets to be extracted through carefully crafted requests. This is due to...
Cisco Identity Services Engine Path Traversal Vulnerability (CNVD-2025-06738)
Cisco Identity Services Engine is an environment-aware platform from Cisco USA. A path traversal vulnerability exists in Cisco Identity Services Engine, which stems from insufficient filtering and validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability...
CVE-2024-52311
Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests until token is expired...
CVE-2024-52311 data.all does not invalidate authentication token upon user logout
Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests until token is expired...
CVE-2024-52311
The CVE-2024-52311 entry concerns data.all (data-dot-all) where authentication tokens issued via Cognito are not invalidated on user logout. This allows a previously authenticated user to continue making authorized API requests until the Cognito token expires. The available connected documents id...
JetBrains YouTrack < 2024.3.47197 Arbitrary Code Execution
The version of JetBrains YouTrack installed on the remote host is prior to 2024.3.47197. It is, therefore, affected by a vulnerability as referenced in the 2024347197 advisory. - Insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests JT-85294 Note that Nessus...
CVE-2024-49579
In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests...
CVE-2024-49579
In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests...
CVE-2024-49579
In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests...
CVE-2024-49579
JetBrains YouTrack prior to 2024.3.47197 is affected by CVE-2024-49579 due to insufficient validation of the iframe plugin communication channel, allowing arbitrary JavaScript execution and unauthorized API requests. The issue stems from the iframe plugin; attacker-controlled payloads could be ex...