CVE-2025-53185

Virtual address reuse issue in the memory management module, which can be exploited by non-privileged users to access released memory Impact: Successful exploitation of this vulnerability may affect service integrity...

PT-2025-28962

Name of the Vulnerable Software and Affected Versions Kaseya Rapid Fire Tools Network Detective version 2.0.16.0 Description Kaseya Rapid Fire Tools Network Detective stores unencrypted credentials for privileged access in the collector.txt configuration file. Recommendations Ensure the...

Credentials stored and displayed in plain text by soapui-pro-functional-testing

soapui-pro-functional-testing 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These credentials can be viewed by users with Item/Extended Read permission or access to the...

API Auth keys stored and displayed in plain text by vaddy-plugin

vaddy-plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additionally, the job...

Enhancing Microsoft 365 security by eliminating high-privilege access

In this blog you will hear directly from Microsoft’s Deputy Chief Information Security Officer CISO for Experiences and Devices, Naresh Kannan, about eliminating high-privileged access across all Microsoft 365 applications. This blog is part of an ongoing series where our Deputy CISOs share their...

CVE-2025-20982

The issue (CVE-2025-20982) affects KnoxVault trustlet on Samsung devices, caused by an out-of-bounds write when setting the auth secret. It applies to KnoxVault trustlet versions prior to SMR Jul-2025 Release 1 and enables local privileged attackers to write memory out-of-bounds. Mitigation: upda...

CVE-2025-36014

IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.5 is vulnerable to code injection by a privileged user with access to the IIB install directory...

CVE-2025-53374

CVE-2025-53374 – Dokploy is a self-hosted PaaS. An authenticated low-privileged user can disclose PII by calling the internal user.one endpoint, exposing email, role, 2FA status, organization ID, and account flags for other users in the same organization. This is a data exposure vulnerability tie...

CVE-2025-53185

Virtual address reuse issue in the memory management module, which can be exploited by non-privileged users to access released memory Impact: Successful exploitation of this vulnerability may affect service integrity...

CVE-2025-53185

Virtual address reuse issue in the memory management module, which can be exploited by non-privileged users to access released memory Impact: Successful exploitation of this vulnerability may affect service integrity...

PT-2025-28299

Name of the Vulnerable Software and Affected Versions: SAP BASIS affected versions not specified Description: The issue is caused by a missing authorization check in an obsolete RFC enabled function module. This allows an authenticated low-privileged attacker to call a Remote Function Call RFC,...

PT-2025-28120 · Huawei +1 · Emui +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A virtual address reuse issue exists in the memory management module. This issue can be exploited by non-privileged users to access released memory, potentially affecting service integrity...

CVE-2025-27021

The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of service, and privilege escalation by...

Delinea Secret Server 安全漏洞

Delinea Secret Server is a powerful PAM in the cloud or locally from Delinea USA. A security vulnerability exists in Delinea Secret Server version 11.7.49 and earlier, which stems from insufficient validation in the initial authorization event and could lead to distributed engine impersonation...

The vulnerability of the CodeScoring software development platform lies in its ability to disclose sensitive information in error messages, allowing a privileged user to expose protected information.

The vulnerability of the CodeScoring software development platform relates to the possibility of exposing sensitive information in error messages. Exploiting this vulnerability could allow a malicious actor, operating remotely with elevated privileges, to disclose protected information...

CVE-2025-52555

A vulnerability in Ceph was discovered whereby an unprivileged user could change the permissions of a directory owned by the root user, gaining access to the targeted directory. The non-privileged user can escalate privileges to root in a CephFS mounted with ceph-fuse by applying chmod 777 read,...

CVE-2025-3091

Affected products include MB Connect Line mbCONNECT24, MB Connect Line mymbCONNECT24, and Helmholz myREX24. CVE-2025-3091 describes a flaw where a low in two-factor authentication allows a low-privileged remote attacker who possesses another users second factor to log in as that user without th...

CVE-2023-47294

NCR Terminal Handler v1.5.1 is vulnerable to an Improper Access Control issue (CWE-284) caused by insufficient session cookie validation. This flaw allows low-level privileged authenticated attackers to use a crafted session cookie to arbitrarily deactivate, lock, and delete user accounts . A pub...

CVE-2025-52969

Removed by vendor...

CVE-2025-5141

A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager BoKS on versions 7.2.0 up to 7.2.0.17, 8.1.0 up to 8.1.0.22, 8.1.1 up to 8.1.1.7, 9.0.0 up to 9.0.0.1 and also legacy tar installs of BoKS 7.2 without hotfix 0474 on Linux, AIX, and Solaris allows low privilege...