Ivanti Connect Secure 日志信息泄露漏洞

Ivanti Connect Secure ICS is a secure remote network connectivity tool from Ivanti Corporation, USA. A log information disclosure vulnerability exists in Ivanti Connect Secure versions prior to 22.7R2.8, which originates when sensitive information is inserted into a log file, potentially leading ...

Juju 安全漏洞

Juju is an open source application orchestration engine from Canonical Juju Open Source. A security vulnerability exists in Juju that stems from insufficient authorization checking in the /log endpoint, which could lead to unauthorized users accessing sensitive information...

PT-2025-28485 · Ivanti · Ivanti Connect Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.8 Description: The issue allows a local authenticated attacker to obtain sensitive information that has been inserted into a log file. Recommendations: For versions prior to 22.7R2.8, update to...

CVE-2025-53539

CVE-2025-53539 affects fastapi-guard: the DoS risk stems from inefficient regular expressions in the SusPatternsManager (suspatterns_handler.py) used to detect penetration attempts, enabling polynomial backtracking under crafted inputs. The vulnerability is documented as fixed in version 3.0.1; r...

CVE-2025-20325

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head cluster splunk.secret key. This exposure could happen if you have a Search Head cluster and...

CVE-2025-20325 Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head cluster splunk.secret key. This exposure could happen if you have a Search Head cluster and...

You Should Run a Certificate Transparency Log

Hear me out. If you are an organization with some spare storage and bandwidth, or an engineer looking to justify an overprovisioned homelab, you should consider running a Certificate Transparency log. It’s cheaper, easier, and more important than you might think. Certificate Transparency CT is on...

CVE-2025-6711 Incomplete Redaction of Sensitive Information in MongoDB Server Logs

An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0 versions prior to 8.0.5, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v6.0...

MongoDB Server 安全漏洞

MongoDB Server is the United States MongoDB company's set of open source NoSQL database . The database provides collection-oriented storage , dynamic query , data replication and automatic failover and other functions . A security vulnerability exists in MongoDB Server versions prior to 8.0.5,...

Pentest-and-Development-Tips

Pentest-and-Development-Tips A collection of pentest and development tips Author: 3gstudent Click on me to view the English version 声明 以下技巧不应用于非法用途 --- Tips 1. 手动端口探测 nmap的-sV可以探测出服务版本，但有些情况下必须手动探测去验证 使用Wireshark获取响应包未免大材小用，可通过nc简单判断 eg. 对于8001端口，nc连接上去，随便输入一个字符串，得到了以下结果： $ nc -vv localhost 8001...

CVE-2025-49846

wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that were visible in the view port have been logged to the iOS system logs in clear text. Wire application logs created and managed by the application itself were not affected,...

Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller

CVE-2025-5777-CitrixBleed CitrixBleed-2 CVE-2025-5777 – proo...

OpenBao Log Information Disclosure Vulnerability

OpenBao is OpenBao open source a sensitive data management software . Versions of OpenBao prior to 2.3.0 suffer from a log message disclosure vulnerability that is exploited by attackers to disclose sensitive information...

Unspecified Vulnerability in Tenable Nessus

Tenable Nessus is a network vulnerability scanning tool developed by Tenable, Inc. to detect security vulnerabilities in networks and provide recommendations for fixing them. Tenable Nessus has a security vulnerability that can be exploited by an attacker to overwrite arbitrary local system files...

Red Hat OpenShift Jenkins 日志信息泄露漏洞

Red Hat OpenShift Jenkins is an automated build software from Red Hat USA. Red Hat OpenShift Jenkins suffers from a log information disclosure vulnerability that stems from unobfuscated bearer tokens in the logs, which could lead to the environment being compromised by a malicious user...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Flask-CORS vulnerabilities (USN-7612-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7612-1 advisory. It was discovered that Flask-CORS did not correctly handle certain regular expressions. A remote attacker could...

Zyxel Router Command Injection

Firmware version of the Zyxel TCLinux device is affected by command injection vulnerability: - The ZyXEL three router models - ZyXEL P660HN-T1A v1, ZyXEL P660HN-T1A v2 and Billion 5200W-T - router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding...

PT-2025-27867 · Red Hat · Red Hat Openshift Jenkins

Name of the Vulnerable Software and Affected Versions: Red Hat OpenShift Jenkins affected versions not specified Description: A flaw was found in the way the bearer token is handled. The bearer token is not obfuscated in the logs, which could pose a high risk if these logs are centralized during...

Fedora 41 : guacamole-server (2025-c597fcda32)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c597fcda32 advisory. Apache Guacamole 1.6.0 User interface / platform Add the ability to specify separate permissions for History and Active sessions tabs GUACAMOLE-538...

CVE-2025-34064

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket onelogin-adc-logs-production without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. The...