CVE-2025-49147 Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements

Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The informatio...

CVE-2025-49147

CVE-2025-49147 affects Umbraco CMS up to versions 10.8.10 and 13.9.1. An anonymously accessible endpoint reveals configured password policy details, which could plausibly assist brute‑force attempts. Patched in 10.8.11 and 13.9.2; upgrades to these versions are recommended. Other versions (7/8, 1...

CVE-2025-49147 Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements

Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The informatio...

CVE-2025-49147 Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements

Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The informatio...

CVE-2025-48461

Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords...

CVE-2025-48461

CVE-2025-48461 involves weak, predictable session cookies that enable an unauthenticated attacker to perform brute‑force guessing and account takeover, potentially gaining root/admin/user access and resetting passwords. Connected sources reference affected Advantech industrial controllers (WISE-4...

CVE-2025-48461 Weak Session Cookie Entropy

Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords...

CVE-2025-48461 Weak Session Cookie Entropy

Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords...

PT-2025-26763 · Umbraco · Umbraco

Name of the Vulnerable Software and Affected Versions: Umbraco versions 10.0.0 through 10.8.10 Umbraco versions 13.0.0 through 13.9.1 Description: The issue allows an attacker to retrieve information about the configured password requirements via a request to an anonymously authenticated endpoint...

Umbraco 安全漏洞

Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. A security vulnerability exists in Umbraco versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1, which stems from configured password requirement information that can be retrieved via an anonymous...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to directory traversal due to the pip package (CVE-2019-20916)

Summary Pip is used by DataStage on Cloud Pak for Data as part of package management. Vulnerability Details CVEID:CVE-2019-20916 DESCRIPTION: The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have...

CVE-2025-2171

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN...

CVE-2025-2171

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN...

CVE-2025-2171

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN...

CVE-2025-52916

Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration last five digits...

PT-2025-26596 · Aviatrix · Aviatrix Controller

Name of the Vulnerable Software and Affected Versions: Aviatrix Controller versions prior to 7.1.4208 Aviatrix Controller versions prior to 7.2.5090 Aviatrix Controller versions prior to 8.0.0 Description: The issue concerns the lack of rate limiting on password reset attempts in Aviatrix...

PT-2025-26675 · Apache · Apache

Name of the Vulnerable Software and Affected Versions: Apache affected versions not specified Description: The issue allows an unauthenticated attacker to conduct brute force guessing and account takeover due to predictable session cookies. This could potentially allow attackers to gain root,...

Aviatrix Controller 安全漏洞

Aviatrix Controller is a software application from the American company Aviatrix. Extend and control the native structure with the cloud provider's APIs to extend its functionality and integrate it into the software. A security vulnerability exists in Aviatrix Controller versions prior to 7.1.420...

CVE-2025-52916

Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration last five digits...

Violence-as-a-Service: Encrypted Apps Used in Recruiting Teens as Hitmen

European police, led by Denmark and Sweden, are arresting individuals in a crackdown on violence-as-a-service, where criminal groups recruit teenagers online for contract killings. Learn about Europol's OTF GRIMM task force and how they're fighting this disturbing trend...