Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Flask-CORS vulnerabilities (USN-7612-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7612-1 advisory. It was discovered that Flask-CORS did not correctly handle certain regular expressions. A remote attacker could...

Zyxel Router Command Injection

Firmware version of the Zyxel TCLinux device is affected by command injection vulnerability: - The ZyXEL three router models - ZyXEL P660HN-T1A v1, ZyXEL P660HN-T1A v2 and Billion 5200W-T - router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding...

PT-2025-27867 · Red Hat · Red Hat Openshift Jenkins

Name of the Vulnerable Software and Affected Versions: Red Hat OpenShift Jenkins affected versions not specified Description: A flaw was found in the way the bearer token is handled. The bearer token is not obfuscated in the logs, which could pose a high risk if these logs are centralized during...

Fedora 41 : guacamole-server (2025-c597fcda32)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c597fcda32 advisory. Apache Guacamole 1.6.0 User interface / platform Add the ability to specify separate permissions for History and Active sessions tabs GUACAMOLE-538...

CVE-2025-34064

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket onelogin-adc-logs-production without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. The...

CVE-2025-6587

System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This leads to unintentional disclosure of sensitive information such as api keys, passwords, etc. A malicious actor with read access to these logs could obtain secrets and further use...

AZL-72722 CVE-2025-38126 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptprate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clkptprate value after having retrieved the default one from the device-tree can end up with 0 in...

Wire Swiss wire-ios 安全漏洞

Wire Swiss wire-ios is an iOS application from Wire Swiss open source. A security vulnerability exists in Wire Swiss wire-ios versions prior to 3.111.1 through 3.124.1, which originates from messages being logged in plaintext to the iOS system log, potentially leading to information disclosure...

PT-2025-27790 · Unknown · Epc2 Windows

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue allows the device to automatically log in the EPC2 Windows user during startup without requesting a password. Recommendations: At the moment, there is no information about a newer...

Malicious code in dotenv-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 983b0b06a5013d619d699ddcdaf39ce8118a63537d7243760571684111b2c921 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5550 Malicious code in dotenv-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 983b0b06a5013d619d699ddcdaf39ce8118a63537d7243760571684111b2c921 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-mongoose-orm (npm)

The package employs typosquatting to impersonate a legitimate author and package, and it contains obfuscated code that exfiltrates sensitive user data and creates a backdoor for remote code execution, The core of the malicious activity is found in the package/lib/writer.js file. The lib/writer.js...

USN-7612-1: Flask-CORS vulnerabilities

It was discovered that Flask-CORS did not correctly handle certain regular expressions. A remote attacker could possibly use this issue to leak sensitive information or bypass authentication mechanisms. CVE-2024-6839 It was discovered that Flask-CORS allowed certain CORS headers to be enabled by...

USN-7612-1 python-flask-cors vulnerabilities

It was discovered that Flask-CORS did not correctly handle certain regular expressions. A remote attacker could possibly use this issue to leak sensitive information or bypass authentication mechanisms. CVE-2024-6839 It was discovered that Flask-CORS allowed certain CORS headers to be enabled by...

CVE-2025-36630

In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege...

CVE-2025-34064

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket onelogin-adc-logs-production without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. The...

CVE-2025-34064 OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket onelogin-adc-logs-production without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. The...

CVE-2025-34064 OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket onelogin-adc-logs-production without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. The...

Insertion Of Sensitive Information Into Log File

snyk is vulnerable to Insertion of Sensitive Information into Log File. The vulnerability is due to improper logging of sensitive data because of debug and trace log modes capturing container registry credentials, authentication tokens, and access tokens when certain CLI commands are executed...

Tenable Nessus 安全漏洞

Tenable Nessus is a network vulnerability scanning tool developed by Tenable, Inc. to detect security vulnerabilities in networks and provide recommendations for fixing them. Tenable Nessus has a security vulnerability that can be exploited by an attacker to overwrite arbitrary local system files...