Nagios Log Server 安全漏洞

Nagios Log Server is a suite of centralized log management, monitoring, and analysis software from Nagios, Inc. A security vulnerability exists in Nagios Log Server versions prior to 2024R1.3.2, which originates from an authenticated user being able to stop the Elasticsearch service via an API...

CubeAPM 安全漏洞

CubeAPM is a code development tool from CubeAPM, Inc. A security vulnerability exists in the CubeAPM nightly-2025-08-01-1 release that originates from an unauthenticated attacker being able to inject arbitrary log entries via the /api/logs/insert/elasticsearch/bulk endpoint, which could lead to l...

Amazon AWS VPN Client 安全漏洞

Amazon AWS VPN Client is a fully managed remote access VPN solution from Amazon.com, Inc. A security vulnerability exists in Amazon AWS VPN Client versions 1.3.2 through 5.2.0, which stems from insufficient validation of the log target directory during log rotation, and could lead to elevation of...

CVE-2025-44824

Nagios Log Server prior to 2024R1.3.2 is affected by CVE-2025-44824. An authenticated user with read-only API access can call /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch to stop Elasticsearch. The API reportedly returns could not stop elasticsearch, yet the service stops, e...

PT-2025-41175

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2024R1.3.2 Description Nagios Log Server before version 2024R1.3.2 allows authenticated users with read-only API access to stop the Elasticsearch service. This is achieved by making a call to the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414384)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414384 advisory. A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfsattachlogwriter of the file...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986387)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986387 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential hang in nilfsdetachlogwriter Syzbot has reported a potential hang in...

Unity Linux 20.1070e Security Update: httpd (UTSA-2025-987457)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987457 advisory. Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into lo...

WordPress plugin WP Reset 日志信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A log...

CVE-2025-44823

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/getusers call. This is GL:NLS475...

CVE-2025-44824

Nagios Log Server before 2024R1.3.2 allows authenticated users with read-only API access to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response...

CVE-2025-44824

Nagios Log Server before 2024R1.3.2 allows authenticated users with read-only API access to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response...

CVE-2025-44823

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/getusers call. This is GL:NLS475...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-386953)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-386953 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of timer for log writer thread Patch series nilfs2: fix log writer...

CVE-2025-44823

Nagios Log Server (before 2024R1.3.2) is vulnerable: unauthenticated? No—authenticated users with access to the API can call /nagioslogserver/index.php/api/system/get_users to retrieve cleartext admin API keys. The underlying issue exposes user accounts and API keys, enabling full system compromi...

CVE-2025-57564

CVE-2025-57564 affects CubeAPM core (nightly-2025-08-01-1). An unauthenticated attacker can inject arbitrary log entries via the /api/logs/insert/elasticsearch/_bulk endpoint due to lack of authentication/input validation, potentially causing log poisoning, false entries, alert obfuscation, and o...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-395439)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-395439 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix state management in error path of log writing function After commit a694291a6211...

EUVD-2025-32585

The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials...

CVE-2025-54293

Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links...

CERTFR-2025-ACT-042

creationtimestamp| type| source ---|---|--- 2025-10-06 12:16:16+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3m2jlpjxrys2o 2025-10-06 12:16:19+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115327170971965048 2025-10-07 16:12:01+00:00| seen|...