20218 matches found
CVE-2025-36083
IBM Concert Software (versions 1.0.0–2.0.0) exposes a local-information-disclosure vulnerability due to improper clearing of heap memory before release. This could allow a local attacker to obtain sensitive data from buffers. Remediation: upgrade to IBM Concert Software 2.1.0 as indicated by IBM’...
CVE-2025-62979
Insertion of Sensitive Information Into Sent Data vulnerability in airesvsg ACF to REST API acf-to-rest-api allows Retrieve Embedded Sensitive Data.This issue affects ACF to REST API: from n/a through = 3.3.4...
CVE-2025-62902
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedded Sensitive Data.This issue affects WP Popup Builder: from n/a through = 1.3.8...
CVE-2025-54967
An issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able to social engineer a SOCET GXP user into opening a malicious file can trigger a variety of outbound requests, potentially compromising sensitive information in...
CVE-2023-37749
Incorrect access control in the REST API endpoint of HubSpot v1.29441 allows unauthenticated attackers to view users' data without proper authorization...
The vulnerability of the `truncate inode partial folio` function in the Linux operating system allows a hacker to compromise the confidentiality of the protected information.
The vulnerability of the truncate inodePartialFolio function in the Linux operating system is related to reading memory beyond the allocated buffer. Exploiting this vulnerability can allow an attacker to compromise the confidentiality of protected information...
CVE-2025-60800
CVE-2025-60800 affects jshERP, specifically the /jshERP-boot/user/info interface up to commit 90c411a. The root cause is improper access control, allowing an unauthenticated, crafted GET request to disclose sensitive information. Impact per sources: Confidentiality high; no integrity or availabil...
RockyLinux 9 : webkit2gtk3 (RLSA-2025:18097)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:18097 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-43272 webkitgtk: Processing maliciously crafted we...
BES Application Server 安全漏洞
BES Application Server is a high-performance application server software from China Bowland BES. A security vulnerability exists in BES Application Server 9.5.x and earlier versions, which originates from the pre-resource option in bes-web.xml that may lead to sensitive information leakage...
ROS-20251028-11
A vulnerability in the NVIDIA Container Toolkit container creation and launch software and the NVIDIA GPU Operator resource management software is associated with synchronization errors. NVIDIA GPU Operator resource management software is associated with synchronization errors when using a shared...
CVE-2025-60800
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...
CVE-2025-61043
An out-of-bounds read vulnerability has been discovered in Monkey's Audio 11.31, specifically in the CAPECharacterHelper::GetUTF16FromUTF8 function. The issue arises from improper handling of the length of the input UTF-8 string, causing the function to read past the memory boundary. This...
CVE-2025-62516
Rejected reason: Further research determined the issue is not a vulnerability...
EUVD-2025-36211
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internaladmincontactlogin.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information including PII to unauthenticated attackers...
CVE-2025-27225
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internaladmincontactlogin.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information including PII to unauthenticated attackers...
CVE-2025-54967
An issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able to social engineer a SOCET GXP user into opening a malicious file can trigger a variety of outbound requests, potentially compromising sensitive information in...
CVE-2025-54967
An issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able to social engineer a SOCET GXP user into opening a malicious file can trigger a variety of outbound requests, potentially compromising sensitive information in...
CVE-2025-27223
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to...