Sensitive Information Disclosure

github.com/edgelesssys/contrast is vulnerable to information disclosure. The vulnerability is due to improper logging configuration due to secrets being written to stderr and Kubernetes logs when the log level is set to info or debug, which is the default...

CVE-2025-4633

Default credentials were present in the web portal for Airpointer 2.4.107-2, allowing an unauthenticated malicious actor to log in via the web portal...

CVE-2025-4633 Default Credentials

Default credentials were present in the web portal for Airpointer 2.4.107-2, allowing an unauthenticated malicious actor to log in via the web portal...

CVE-2025-4633

CVE-2025-4633 concerns Airpointer 2.4.107-2 where default credentials in the web portal allow an unauthenticated attacker to log in. Affected component: the web portal of Airpointer 2.4.107-2; root cause is default credentials enabling access without authentication. Impact notes from sources indi...

CVE-2025-4633 Default Credentials

Default credentials were present in the web portal for Airpointer 2.4.107-2, allowing an unauthenticated malicious actor to log in via the web portal...

CVE-2025-41438

The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-level permissions that could severely...

PT-2025-23313

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description A privilege escalation issue exists due to a business logic flaw in SOAP admin services. This can be exploited when specific conditions are met, including accessibility of SOAP admin services ...

PT-2025-23270

Name of the Vulnerable Software and Affected Versions: Airpointer version 2.4.107-2 Description: The issue concerns default credentials being present in the web portal, allowing an unauthenticated malicious actor to log in via the web portal. Recommendations: For Airpointer version 2.4.107-2,...

jct-aq Airpointer 2D 信任管理问题漏洞

The jct-aq Airpointer 2D is a device for air quality monitoring from jct-aq Austria. A security vulnerability exists in the jct-aq Airpointer 2D version 2.4.107-2, which stems from default credentials and could lead to unauthorized access...

Lenovo PC Manager 安全漏洞

Lenovo PC Manager is a PC management software from Lenovo China. A security vulnerability exists in Lenovo PC Manager that stems from improper default permissions, which may result in elevated privileges...

Asymmetry by Design: Boosting Cyber Defenders with Differential Access to AI

As AI-enabled cyber capabilities become more advanced, we propose "differential access" as a strategy to tilt the cybersecurity balance toward defense by shaping access to these capabilities. We introduce three possible approaches that form a continuum, becoming progressively more restrictive for...

NetScaler-13.1-How to implement authorization policy for Oauth user groups

In Oauth response, the user groups can be carried in the response with customized field. However, we can't relate the string of group to the group attribute of the user. We may have question for how to apply authorization policy for Oauth user groups. In this example, the default authorization...

CVE-2025-41438 Consilium Safety CS5000 Fire Panel Initialization of a Resource with an Insecure Default

The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-level permissions that could severely...

CVE-2025-41438 Consilium Safety CS5000 Fire Panel Initialization of a Resource with an Insecure Default

The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-level permissions that could severely...

CVE-2025-41438

CVE-2025-41438 affects the Consilium Safety CS5000 Fire Panel. The vulnerability stems from a default account with high-level permissions that remains unchanged across installations, and a hard-coded VNC password embedded in the binary, enabling remote access if network access exists. Affected sy...

CVE-2025-48045 MICI Network Co. Ltd. NetFax Server Default Administrator Credentials Disclosure

An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials...

CVE-2025-48045

CVE-2025-48045 is an unauthenticated risk in the NetFax Server family where an HTTP GET to /client.php discloses the default administrator credentials. The entry carries CVSS v4.0 base metrics (AV:N/AC:L/PR:N/UI:N/SI:N/VI:N/VA:N; Confidentiality High). Red Hat and NVD records corroborate the exac...

CVE-2025-48045, CVE-2025-48046, CVE-2025-48047: MICI NetFax Server Product Vulnerabilities (NOT FIXED)

In the course of a penetration testing engagement, Rapid7 discovered three vulnerabilities in MICI Network Co., Ltd’s NetFax server versions 3.0.1.0. These issues allowed for an authenticated attack chain resulting in Remote Code Execution RCE against the device as the root user. While...

SUSE CVE-2025-32802

Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions...

CVE-2025-48045, CVE-2025-48046, CVE-2025-48047: MICI NetFax Server Product Vulnerabilities (NOT FIXED)

In the course of a penetration testing engagement, Rapid7 discovered three vulnerabilities in MICI Network Co., Ltd’s NetFax server versions 3.0.1.0. These issues allowed for an authenticated attack chain resulting in Remote Code Execution RCE against the device as the root user. While...