4936 matches found
CVE-2025-61789 Icinga DB Web hidden/protected custom variables are prone to filter enumeration
Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values...
dotnet: .NET Security Feature Bypass Vulnerability
A flaw was found in ASP.NET Core’s HTTP request handling that leads to inconsistent interpretation of specially crafted HTTP requests. This mismatch can be abused by an authorized network attacker to smuggle or manipulate request boundaries, allowing bypass of security controls or unintended...
Icinga DB Web 安全漏洞
Icinga DB Web is an Icinga open source graphical interface to the Icinga DB database. A security vulnerability exists in Icinga DB Web versions prior to 1.1.4 and prior to 1.2.3, which originates from an authorized user being able to guess the value of a protected or hidden variable via a custom...
CVE-2025-58724
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...
AZL-72866 CVE-2025-11568 affecting package luksmeta 9-8
A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the...
CVE-2025-11568
A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the...
CVE-2025-59211
Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally...
CVE-2025-58719
Use after free in Connected Devices Platform Service Cdpsvc allows an authorized attacker to elevate privileges locally...
CVE-2025-58729
Improper validation of specified type of input in Windows Local Session Manager LSM allows an authorized attacker to deny service over a network...
CVE-2025-59203
Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally...
CVE-2025-59198
Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally...
CVE-2025-59209
Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally...
CVE-2025-59259
Improper validation of specified type of input in Windows Local Session Manager LSM allows an authorized attacker to deny service over a network...
CVE-2025-59257
Improper validation of specified type of input in Windows Local Session Manager LSM allows an authorized attacker to deny service over a network...
CVE-2025-59204
Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclose information locally...
CVE-2025-55336
Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally...
CVE-2025-55695
Out-of-bounds read in Windows WLAN Auto Config Service allows an authorized attacker to disclose information locally...
CVE-2025-55325
Buffer over-read in Windows Storage Management Provider allows an authorized attacker to disclose information locally...