CVE-2025-24192

A script imports issue was addressed with improved isolation. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Visiting a website may leak sensitive data...

CVE-2025-24192

A script imports issue was addressed with improved isolation. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. Visiting a website may leak sensitive data...

CVE-2025-24192

CVE-2025-24192 pertains to a script-imports issue in Safari and related Apple platforms. The vulnerability was addressed with improved isolation and is fixed in Safari 18.4, visionOS 2.4, iOS 18.4, iPadOS 18.4, and macOS Sequoia 15.4. The issue could allow leakage of sensitive data when visiting ...

CVE-2025-27149

Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries E.g.,...

CVE-2025-27149

Zulip server before 10.0 has a data-export vulnerability (CVE-2025-27149) where export types for organization admins incorrectly included metadata such as user-agent identifiers for integrations and HTTP libraries, and in public data/with-consent exports exposed titles of topics in private channe...

CVE-2025-27149 Zulip exports can leak private data

Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries E.g.,...

PT-2025-55369

Name of the Vulnerable Software and Affected Versions iOS versions prior to 18.4 iPadOS versions prior to 18.4 macOS Sequoia versions prior to 15.4 Description An authorization issue involving state management may allow an application to leak sensitive user information. Recommendations Update iOS...

BlackLock Ransomware Exposed After Researchers Exploit Leak Site Vulnerability

In what's an instance of hacking the hackers, threat hunters have managed to infiltrate the online infrastructure associated with a ransomware group called BlackLock, uncovering crucial information about their modus operandi in the process. Resecurity said it identified a security vulnerability i...

Xiaomi Mi Connect Service APP 安全漏洞

Xiaomi Mi Connect Service APP is an application from China's Xiaomi Xiaomi that is used to enable connectivity and interaction between Xiaomi devices, which helps users to quickly connect and manage a variety of Xiaomi smart devices to enable data transfer and collaborative work between devices. ...

GHSA-FM3H-P9WM-H74H Directus's webhook trigger flows can leak sensitive data

Describe the Bug In Directus, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user...

openvpn -- server-side denial-of-service vulnerability with tls-crypt-v2

Gert Doering reports: OpenVPN servers between 2.6.1 and 2.6.13 using --tls-crypt-v2 can be made to abort with an ASSERT message by sending a particular combination of authenticated and malformed packets. To trigger the bug, a valid tls-crypt-v2 client key is needed, or network observation of a...

CVE-2025-2312

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

CVE-2025-2312 cifs.upcall makes an upcall to the wrong namespace in containerized environments

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

CVE-2024-10267

An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including names, emails, and passwords, by attempting to register a new account with an email that is already in use. The server returns all...

CVE-2024-8183

CVE-2024-8183 affects the Prefect framework (prefect, v2.20.2). The issue is a misconfigured Cross-Origin Resource Sharing (CORS) policy that permits unauthorized domains to access sensitive data, potentially enabling unauthorized access to the database and leading to data leaks, confidentiality ...

USN-7360-1 alpine vulnerabilities

It was discovered that Alpine did not use a secure connection under certain circumstances. A remote attacker could possibly use this issue to leak sensitive information. CVE-2020-14929 It was discovered that Alpine could allow untagged responses from an IMAP server before upgrading to a TLS...

USN-7355-1: RestrictedPython vulnerabilities

Nakul Choudhary and Robert Xiao discovered that RestrictedPython did not properly sanitize certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. CVE-2023-37271 Abhishek Govindarasu, Ankush Menat and War...

CVE-2025-1433

CVE-2025-1433 describes an Out-of-Bounds Read in Autodesk AutoCAD when parsing a malicious MODEL file. Affected component: AutoCAD (MODEL file parsing). Root cause: insufficient validation during MODEL file parsing leading to an out-of-bounds read, enabling crash, data exposure, or arbitrary code...

Autodesk AutoCAD 资源管理错误漏洞

Autodesk AutoCAD is a suite of specialized 3D drawing software from Autodesk, Inc. A security vulnerability exists in Autodesk AutoCAD that originates from parsing a malicious specially crafted 3DM file that could lead to post-release reuse, which could result in a crash, read sensitive data, or...

ROS-20250310-01

Vulnerability of the dpaastartxmit function in the drivers/net/ethernet/freescale/dpaa/dpaaeth.c module of the Linux kernel of the Linux kernel is associated with a data leak. Exploitation of the vulnerability could allow an attacker to affect the confidentiality and availability of protected...