27391 matches found
EUVD-2025-32585
The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials...
CVE-2025-54293
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links...
CERTFR-2025-ACT-042
creationtimestamp| type| source ---|---|--- 2025-10-06 12:16:16+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3m2jlpjxrys2o 2025-10-06 12:16:19+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115327170971965048 2025-10-07 16:12:01+00:00| seen|...
Tucows (VDP): Information Disclosure via Accessible debug.log on ExactHosting
Vulnerability description not provided...
CVE-2025-58580
An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example...
CVE-2025-58582
CVE-2025-58582 affects SICK Enterprise Analytics and SICK Logistic Analytics. The issue stems from logging POST login data without validation, allowing unusually large payloads to be recorded. This can lead to uncontrolled resource consumption and potential impact on availability, as indicated by...
CVE-2025-58582 Uncontrolled Resource Consumption via log file
If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged...
CVE-2025-58580 Injection via log file
An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example...
CVE-2025-58580 Injection via log file
An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example...
CVE-2025-58580
CVE-2025-58580 affects SICK Enterprise Analytics (and related SICK Analytics products) where an API endpoint allows creation of arbitrary log entries via POST without sufficient input validation. The root cause is insecure input handling, enabling an attacker to create manipulated or diluted logs...
EUVD-2025-32499
An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example...
Duplicate Advisory: Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-964p-j4gg-mhwc. This link is maintained to preserve external references. Original Description Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log...
GHSA-7RGR-72HP-9WP3 Duplicate Advisory: Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-964p-j4gg-mhwc. This link is maintained to preserve external references. Original Description Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log...
CVE-2025-50538
Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log...
CVE-2025-29192
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
EUVD-2025-32481
Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log...
CVE-2025-29192
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
CVE-2025-50538
Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log...
CVE-2025-29192
FlowiseAI Flowise prior to 3.0.5 is vulnerable to Cross-Site Scripting (XSS) via FORM and INPUT elements in the chat log when viewed by an admin. The issue is consistently described across sources as a stored XSS variant introduced by insufficient sanitization of chat-log form fields. Affected so...