CVE-2025-50063

Vulnerability in Oracle Java SE component: Install. The supported version that is affected is Oracle Java SE: 8u451. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. Successful attacks...

CVE-2025-48795

A log processing flaw was found in Apache CXF. Large stream-based messages are stored as temporary files on the local file system, read into memory, and then logged. This flaw allows an attacker to cause a denial of service attack by triggering an out-of-memory exception. Additionally, it is...

CVE-2025-53825

Dokploy (PaaS) unreleased/preview deployments feature: prior to 0.24.3, unauthenticated preview deployments allow any user to execute arbitrary code and read sensitive environment variables by opening a pull request in a public repository. This is described as a remote code execution risk affecti...

wildfly: Wildfly vulnerable to Cross-Site Scripting (XSS)

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server...

wildfly: Wildfly vulnerable to Cross-Site Scripting (XSS)

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server...

wildfly: Wildfly vulnerable to Cross-Site Scripting (XSS)

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server...

wildfly: Wildfly vulnerable to Cross-Site Scripting (XSS)

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server...

Dokploy 安全漏洞

Dokploy is an open source software from Dokploy Open Source. A security vulnerability exists in Dokploy versions prior to 0.24.3 that stems from arbitrary code execution in the unauthenticated Preview Deployment feature, which could lead to the disclosure of sensitive environment variables...

CVE-2024-38648

A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials...

CVE-2025-53676

Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

executorch 安全漏洞

executorch is a PyTorch deployment tool from pytorch open source. A security vulnerability exists in executorch that stems from a heap buffer overflow when loading ExecuTorch methods, which could lead to code execution...

CVE-2025-48820

Improper link resolution before file access 'link following' in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally...

CVE-2025-7424

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of...

GHSA-23J7-PX3W-JWP2 Jenkins Xooa Plugin vulnerability does not mask its Xooa Deployment Token

Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to observe and capture it...

Jenkins Xooa Plugin vulnerability does not mask its Xooa Deployment Token

Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to observe and capture it...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the global configuration form where the Xooa Deployment Token is displayed in plain text. An attacker can obtain sensitive authentication credentials by viewing the configuration form. Remediation...

Credential Exposure

Overview Affected versions of this package are vulnerable to Credential Exposure in the storage of the Xooa Deployment Token in the global configuration file on the Jenkins controller. An attacker can gain unauthorized access to sensitive credentials by obtaining access to the Jenkins controller...

CVE-2025-53676

Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53677

Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2025-53374

Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in the same organization by directly invoking user.one. The...