CVE-2025-36599

Summary: Dell PowerFlex Manager VM (Dell PowerFlex Manager VM) versions before 4.6.2.1 are affected by an insertion of sensitive information into log files. A low-privileged, remote attacker could exploit this to disclose user credentials and potentially access the system with the compromised acc...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the job configuration form, where sensitive Qmetry Automation API Keys are not properly masked. An attacker can gain unauthorized access to confidential credentials by viewing the...

CVE-2025-53651

Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller file system in the build log...

CVE-2025-53650

Jenkins Credentials Binding Plugin 687.v619cb15e923f and earlier does not properly mask i.e., replace with asterisks credentials present in exception error messages that are written to the build log...

CVE-2025-53651

Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller file system in the build log...

CVE-2025-53651

Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller file system in the build log...

CVE-2025-53651

Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller file system in the build log...

CVE-2025-53650

Jenkins Credentials Binding Plugin 687.v619cb15e923f and earlier does not properly mask i.e., replace with asterisks credentials present in exception error messages that are written to the build log...

CVE-2025-53650

Jenkins Credentials Binding Plugin 687.v619cb15e923f and earlier does not properly mask i.e., replace with asterisks credentials present in exception error messages that are written to the build log...

CVE-2025-53650

CVE-2025-53650 affects Jenkins Credentials Binding Plugin (687.v619cb_15e923f and earlier). The root cause is that credentials are not properly masked in exception error messages written to build logs, potentially exposing secrets. Documented CVSS v3.1 base score is 7.3 (HIGH) with network attack...

GHSA-R64V-82FH-XC63 Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization

Impact Any user with a Juju account on a controller can read debug log messages from the /log endpoint. No specific permissions are required - it's just sufficient for the user to exist in the controller user database. The log messages may contain sensitive information. Details The /log endpoint ...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /log endpoint. An attacker can access sensitive debug log messages by authenticating with valid user credentials, even without proper authorization. Remediation Upgrade github.com/juju/juju/apiserver to...

Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization

Impact Any user with a Juju account on a controller can read debug log messages from the /log endpoint. No specific permissions are required - it's just sufficient for the user to exist in the controller user database. The log messages may contain sensitive information. Details The /log endpoint ...

U.S. Dept Of Defense: Critical PII Data Exposure in ORDER_ERROR_LOG

A critical security vulnerability was identified in the application's error logging system. The ORDERERRORLOG file contained complete database insertion statements that exposed personally identifiable information of customers in plain text format. The error handling mechanism was logging full SQL...

UBUNTU-CVE-2025-38243

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid inode pointer dereferences during log replay In a few places where we call readoneinode, if we get a NULL pointer we end up jumping into an error path, or fallthrough in case of addinoderef, where we then do...

CVE-2025-38243

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid inode pointer dereferences during log replay In a few places where we call readoneinode, if we get a NULL pointer we end up jumping into an error path, or fallthrough in case of addinoderef, where we then do...

CVE-2025-38243

The CVE-2025-38243 issue affects the Linux kernel’s Btrfs log replay path. In several locations that call read_one_inode(), a NULL inode pointer could be dereferenced (e.g., iput(&inode->vfs_inode) in __add_inode_ref()), causing an invalid memory access and a crash. The available connected doc...

CVE-2025-38243 btrfs: fix invalid inode pointer dereferences during log replay

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid inode pointer dereferences during log replay In a few places where we call readoneinode, if we get a NULL pointer we end up jumping into an error path, or fallthrough in case of addinoderef, where we then do...

CVE-2025-38243 btrfs: fix invalid inode pointer dereferences during log replay

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid inode pointer dereferences during log replay In a few places where we call readoneinode, if we get a NULL pointer we end up jumping into an error path, or fallthrough in case of addinoderef, where we then do...

Dell PowerFlex Manager VM 日志信息泄露漏洞

Dell PowerFlex Manager VM is a virtual machine software from Dell for managing and monitoring storage systems. A log information disclosure vulnerability exists in Dell PowerFlex Manager VM versions prior to 4.6.2.1. An attacker could exploit this vulnerability to obtain user credentials and then...