CVE-2025-13611 Insertion of Sensitive Information into Log File in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions...

CVE-2025-13611 Insertion of Sensitive Information into Log File in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions...

CVE-2025-13611

GitLab CVE-2025-13611 affects GitLab CE/EE versions 13.2 to 18.4.5, 18.5 to 18.5.3, and 18.6 to 18.6.1. An authenticated user with access to certain logs could obtain sensitive tokens under specific conditions. The issue has been remediated by patches in GitLab, with fixed releases noted as 18.6....

CVE-2025-62346

A Cross-Site Request Forgery CSRF vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malicious action on a trusted site where the user is authenticated, specifically on one endpoint...

CVE-2025-66026

CVE-2025-66026 is a reflected XSS in REDAXO CMS (pre-5.20.1) affecting the Mediapool view where args[types] is echoed into an info banner without escaping. The root cause is lack of HTML-escaping when rendering the value, allowing an authenticated user to trigger arbitrary JavaScript execution in...

PT-2025-48183

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.7 through 18.4.4 GitLab EE versions 18.5 through 18.5.2 GitLab EE versions 18.6 through 18.6.0 Description An authenticated user could potentially view information from security reports under specific configuration...

GitLab CE/EE 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab CE/EE versions 8.3 through before 18.4.5, 18...

GitLab EE 安全漏洞

GitLab Enterprise Edition EE is a content management system from the American company GitLab. A security vulnerability exists in GitLab EE versions 13.7 through 18.4.5 prior, 18.5 through 18.5.3 prior, and 18.6 through 18.6.1 prior, which stems from the ability of an authenticated user to view...

GitLab 日志信息泄露漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc.GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A log information disclosure vulnerability exists in GitLab CE/EE versions 13.2 through...

PT-2025-48187

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 8.3 through 18.4.4 GitLab CE/EE versions 18.5 through 18.5.2 GitLab CE/EE versions 18.6 through 18.6.0 Description An authenticated user with specific permissions could cause a denial of service condition through HTTP...

GHSA-X6VR-Q3VF-VQGQ REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]

Summary A reflected Cross-Site Scripting XSS vulnerability exists in the Mediapool view where the request parameter argstypes is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context when an authenticated user visits a crafted link...

CVE-2025-40890

A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a victim can be...

CVE-2025-40890

CVE-2025-40890 is a stored Cross-Site Scripting (XSS) vulnerability in the Dashboards feature of Nozomi Networks Guardian/CMC. The issue stems from improper validation of input parameters, enabling an authenticated, low-privilege user to craft and share a malicious dashboard containing JavaScript...

CVE-2025-40890 Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0

A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a victim can be...

PT-2025-48042

Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of their privilege level including standard or low-privileged users, can make a GET request to this endpoint and retrieve a...

CVE-2025-64061

Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of their privilege level including standard or low-privileged users, can make a GET request to this endpoint and retrieve a...

CVE-2025-64061

Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of their privilege level including standard or low-privileged users, can make a GET request to this endpoint and retrieve a...

CVE-2025-64065

The Primakon Pi Portal 1.0.18 API /api/V2/ppudfvadmin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH...

Redis: Redis is vulnerable to DoS via specially crafted LUA scripts

A vulnerability was found in Redis where an authenticated user to run a crafted Lua script that can read out‑of‑bounds memory or crash the server, leading to information disclosure and denial of service...

Redis: Redis is vulnerable to DoS via specially crafted LUA scripts

A vulnerability was found in Redis where an authenticated user to run a crafted Lua script that can read out‑of‑bounds memory or crash the server, leading to information disclosure and denial of service...