PT-2025-41175

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2024R1.3.2 Description Nagios Log Server before version 2024R1.3.2 allows authenticated users with read-only API access to stop the Elasticsearch service. This is achieved by making a call to the...

Evidence of Cognitive Biases in Capture-The-Flag Cybersecurity Competitions

Understanding how cognitive biases influence adversarial decision-making is essential for developing effective cyber defenses. Capture-the-Flag CTF competitions provide an ecologically valid testbed to study attacker behavior at scale, simulating real-world intrusion scenarios under pressure. We...

Amazon AWS VPN Client 安全漏洞

Amazon AWS VPN Client is a fully managed remote access VPN solution from Amazon.com, Inc. A security vulnerability exists in Amazon AWS VPN Client versions 1.3.2 through 5.2.0, which stems from insufficient validation of the log target directory during log rotation, and could lead to elevation of...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986387)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986387 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential hang in nilfsdetachlogwriter Syzbot has reported a potential hang in...

Unity Linux 20.1070e Security Update: httpd (UTSA-2025-987457)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987457 advisory. Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into lo...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414384)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414384 advisory. A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfsattachlogwriter of the file...

CVE-2025-44823

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/getusers call. This is GL:NLS475...

WordPress plugin WP Reset 日志信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A log...

CVE-2025-57564

CVE-2025-57564 affects CubeAPM core (nightly-2025-08-01-1). An unauthenticated attacker can inject arbitrary log entries via the /api/logs/insert/elasticsearch/_bulk endpoint due to lack of authentication/input validation, potentially causing log poisoning, false entries, alert obfuscation, and o...

CVE-2025-44823

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/getusers call. This is GL:NLS475...

CVE-2025-44824

Nagios Log Server before 2024R1.3.2 allows authenticated users with read-only API access to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response...

CVE-2025-44824

Nagios Log Server before 2024R1.3.2 allows authenticated users with read-only API access to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response...

CVE-2025-44823

Nagios Log Server (before 2024R1.3.2) is vulnerable: unauthenticated? No—authenticated users with access to the API can call /nagioslogserver/index.php/api/system/get_users to retrieve cleartext admin API keys. The underlying issue exposes user accounts and API keys, enabling full system compromi...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-386953)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-386953 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of timer for log writer thread Patch series nilfs2: fix log writer...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-395439)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-395439 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix state management in error path of log writing function After commit a694291a6211...

EUVD-2025-32585

The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials...

CVE-2025-54293

Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links...

CERTFR-2025-ACT-042

creationtimestamp| type| source ---|---|--- 2025-10-06 12:16:16+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3m2jlpjxrys2o 2025-10-06 12:16:19+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115327170971965048 2025-10-07 16:12:01+00:00| seen|...

Tucows (VDP): Information Disclosure via Accessible debug.log on ExactHosting

Vulnerability description not provided...

CVE-2025-58580

An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example...