4769 matches found
CVE-2025-53640: Exposure of Sensitive Information to an Unauthorized Actor
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such ...
Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
...
Marvell QConvergeConsole Path Traversal Vulnerability (CNVD-2025-20442)
Marvell QConvergeConsole is a unified adapter management software across data centers from Marvell USA. A path traversal vulnerability exists in Marvell QConvergeConsole due to an error in the compressFirmwareDumpFiles method. An attacker could exploit this vulnerability to disclose information i...
Azure Linux 3.0 Security Update: kernel (CVE-2025-38152)
The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38152 advisory. - In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Clear tablesz when...
CVE-2025-52579: Cleartext Storage of Sensitive Information in Memory
Emerson ValveLink Products store sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, or remain uncleared if the product crashes, or if the programmer does not properly clear the memory before freeing it...
CVE-2025-52579 Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory
Emerson ValveLink Products store sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, or remain uncleared if the product crashes, or if the programmer does not properly clear the memory before freeing it...
CVE-2025-52579 Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory
Emerson ValveLink Products store sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, or remain uncleared if the product crashes, or if the programmer does not properly clear the memory before freeing it...
CVE-2025-6392
Brocade SANnav before Brocade SANnav 2.4.0a could log database passwords in clear text in audit logs when the daily data dump collector invokes docker exec commands. These audit logs are the local server VM’s audit logs and are not controlled by SANnav. These logs are only visible to the server...
Broadcom Brocade SANnav 日志信息泄露漏洞
Broadcom Brocade SANnav is a storage area network management and automation software platform from Broadcom, Inc. A security vulnerability exists in Broadcom Brocade SANnav versions prior to 2.4.0a, which stems from a daily data dump collector that may record database passwords in plaintext to...
PT-2025-31074
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition can occur when agg is modified while other threads access it concurrently, potentially leading to a NULL dereference or a use-after-free. The issue arises from concurren...
SUSE SLED15: libsystemd0 / libsystemd0-32bit / libudev1 / libudev1-32bit / etc (SUSE-SU-2025:02244-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02244-1 advisory. - CVE-2025-4598: Fixed race condition that allows a local attacker to crash a SUID program and gain read...
Security update for systemd
This update for systemd fixes the following issues: CVE-2025-4598: Fixed race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump bsc1243935. Other bugfixes: logs-show: get timestamp and boot ID only when necessary bsc1242827. Patch...
SUSE-SU-2025:02244-1 Security update for systemd
This update for systemd fixes the following issues: - CVE-2025-4598: Fixed race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump bsc1243935. Other bugfixes: - logs-show: get timestamp and boot ID only when necessary bsc1242827...
Security update for systemd
This update for systemd fixes the following issues: CVE-2025-4598: Fixed race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump bsc1243935. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods li...
Multiple vulnerabilities detected in PostgreSQL
Multiple PostgreSQL vulnerability updates CVE-2025-1094-PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2024-10979-PostgreSQL PL/Perl environment variable changes execute arbitrary code CVE-2024-10978-PostgreSQL SET ROLE, SET SESSION AUTHORIZATI...
CitrixBleed-2 Out-Of-Bounds Read
CVE-2025-5777 is a critical unauthenticated out-of-bounds read in Citrix NetScaler ADC/Gateway Gateway or AAA vServer mode. A single crafted request can dump memory containing session tokens, enabling full authentication bypass—earning the nickname CitrixBleed 2. This is a proof of concept exploi...
Marvell QConvergeConsole 路径遍历漏洞
Marvell QConvergeConsole is a unified adapter management software across data centers from Marvell USA. A path traversal vulnerability exists in Marvell QConvergeConsole due to an error in the compressFirmwareDumpFiles method. An attacker could exploit this vulnerability to disclose information i...
Exposure of Core Dump File to an Unauthorized Control Sphere
Overview Affected versions of this package are vulnerable to Exposure of Core Dump File to an Unauthorized Control Sphere via the heapdump endpoint, which is introduced through the use of Spring Boot Actuators. An attacker can access sensitive memory information by sending requests to this...
PT-2025-28022 · Zipkin +1 · Zipkin +1
Name of the Vulnerable Software and Affected Versions: Zipkin versions prior to 3.5.2 Description: The issue is related to the exposure of heap dump information through the "/heapdump" endpoint, which is associated with the use of Spring Boot Actuator. This endpoint is similar to a previously...