CVE-2025-49830 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to path traversal and file disclosure

Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy yaml parser to reference files on the Secrets Manager, Self-Hosted server. These references may be used as reconnaissance to better understand th...

CVE-2025-49829

CVE-2025-49829 affects CyberArk Conjur: OSS prior to 1.22.1 and Secrets Manager, Self-Hosted prior to 13.5.1/13.6.1. Root cause is missing validations in Secrets Manager, Self-Hosted allowing authenticated attackers to inject resources into the database and bypass permission checks. Impacts inclu...

CVE-2025-49829 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations

Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager, Self-Hosted allows authenticated attackers to inject resources into the database and to bypass permission checks. This issue affects Secrets Manager, Self-Hosted formerly Conjur...

CVE-2025-49829 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations

Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager, Self-Hosted allows authenticated attackers to inject resources into the database and to bypass permission checks. This issue affects Secrets Manager, Self-Hosted formerly Conjur...

CVE-2025-49828 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Execution

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted formerly known as Conjur Enterprise 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secre...

CVE-2025-49828 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Execution

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted formerly known as Conjur Enterprise 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secre...

CVE-2025-49827 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Bypass of IAM Authenticator

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.22.0 and Secrets Manager, Self-Hosted formerly known as Conjur Enterprise 13.1 through 13.5 and 13.6 are vulnerable to bypass of the IAM authenticator. An attacker who can manipula...

CVE-2025-49827 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Bypass of IAM Authenticator

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.22.0 and Secrets Manager, Self-Hosted formerly known as Conjur Enterprise 13.1 through 13.5 and 13.6 are vulnerable to bypass of the IAM authenticator. An attacker who can manipula...

CVE-2025-53906

creationtimestamp| type| source ---|---|--- 2025-07-15 18:45:13+00:00| seen| https://seclists.org/oss-sec/2025/q3/41 2025-07-16 13:33:37+00:00| seen| https://bsky.app/profile/undercodenews.bsky.social/post/3lu3jsdr4gu2n 2025-07-16 20:47:08+00:00| seen|...

PT-2025-29612

Name of the Vulnerable Software and Affected Versions Conjur OSS versions 1.19.5 through 1.22.0 Secrets Manager, Self-Hosted versions 13.1 through 13.6 Description Conjur provides secrets management and application identity for infrastructure. A malformed regular expression allows an attacker...

PT-2025-29673 · Cyberark · Secrets Manager +1

Name of the Vulnerable Software and Affected Versions: CyberArk Secrets Manager, Self-Hosted versions prior to 13.5.1 and 13.6.1 Conjur OSS versions prior to 1.22.1 Description: An attacker with access to a misconfigured network device routing traffic from Secrets Manager to AWS can redirect...

PT-2025-29613 · Cyberark · Secrets Manager +1

Name of the Vulnerable Software and Affected Versions: Conjur OSS versions 1.19.5 through 1.21.1 Secrets Manager, Self-Hosted versions 13.1 through 13.4.1 Description: Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who can inject secrets ...

OSV-2025-544 Heap-buffer-overflow in N_BELE_RTP::LEPolicy::get32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430110068 Crash type: Heap-buffer-overflow READ 4 Crash state: NBELERTP::LEPolicy::get32 PackLinuxElf32::elflookup PackLinuxElf32::PackLinuxElf32help1...

OSV-2025-541 Heap-buffer-overflow in js_create_function

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430091578 Crash type: Heap-buffer-overflow READ 2 Crash state: jscreatefunction JSEvalInternal JSEvalObject...

OSV-2025-538 Heap-double-free in policydb_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430091583 Crash type: Heap-double-free Crash state: policydbdestroy checkpolicy-fuzzer.c definegenfscontext...

OSV-2025-534 Heap-use-after-free in ih264_inter_pred_luma_horz_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428771938 Crash type: Heap-use-after-free READ 16 Crash state: ih264interpredlumahorzssse3 ih264dmotioncompensatemp isvcddecoderecontfrnmbnonbaselyr...

OSV-2025-528 Heap-buffer-overflow in xmlnode_parser_structural_error_libxml

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=429429092 Crash type: Heap-buffer-overflow WRITE 4 Crash state: xmlnodeparserstructuralerrorlibxml xmlRaiseError xmlParseAttValueInternal...

OSV-2025-525 UNKNOWN READ in std::__1::__function::__func<cv::PngDecoder::compose_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=429429085 Crash type: UNKNOWN READ Crash state: std::1::function::funccv::PngDecoder::composeframe cv::ParallelLoopBodyWrapper::operator cv::ThreadPool::run...

OSV-2025-500 UNKNOWN READ in getUShort

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428022218 Crash type: UNKNOWN READ Crash state: getUShort disInstrTHUMBWRK disInstrARM...

CVE-2025-5372

creationtimestamp| type| source ---|---|--- 2025-06-27 17:14:17+00:00| seen| https://seclists.org/oss-sec/2025/q2/284 2025-07-04 06:35:19+00:00| seen| https://bsky.app/profile/potato.software/post/3lt4mtdeqfs2x 2025-07-04 09:25:26+00:00| seen|...