The vulnerability of the SSH protocol implementation in the JetBrains Toolbox, a set of development tools, allows attackers to expose protected information.

The vulnerability of the SSH protocol implementation in the JetBrains Toolbox suite of tools is related to the transmission of credentials in an unencrypted form. Exploiting this vulnerability could allow a perpetrator to disclose the protected information...

ROS-20250424-14

Vulnerability in Apache Tomcat application server's JNDIRealm module implementation is related to flaws in the authentication mechanism. authentication mechanism. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access to protected information. Unauthorized...

mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

A flaw was found in modauthopenidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present...

mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

A flaw was found in modauthopenidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present...

CVE-2025-1056

Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A non-admin user can modify this file to either create files or change the content of files in an admin-protected location. Axis has released a patched version...

AXIS Camera Station Pro 安全漏洞

AXIS Camera Station Pro is a powerful and flexible video management and access control from Axis Sweden. AXIS Camera Station Pro has a security vulnerability that originates from the possibility that a non-administrative user could modify specific files, resulting in the creation or alteration of...

The vulnerability of the UpdateTcmSettings method in the software for managing and monitoring removed objects in telemetering and telemechanics systems allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the UpdateTcmSettings method in the software for managing and monitoring removed objects in telemetering and telemechanics systems is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to compromise the...

The vulnerability of the SAP Commerce Cloud e-commerce platform, related to deficiencies in authentication procedures, allows a perpetrator to compromise the confidentiality of protected information.

The vulnerability of the SAP Commerce Cloud e-commerce platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality of the protected information...

The vulnerability of SAP Capital Yield Tax Management software lies in incorrect restrictions on the path to the catalog, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the SAP Capital Yield Tax Management software relates to incorrect restrictions on the path name to the catalog. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the PHP library TCPDF, related to incorrect pathname restrictions for restricted access directories, allows attackers to gain unauthorized access to protected information.

The vulnerability of the PHP library TCPDF lies in the incorrect path limitation for the access to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the CloudKit component in iPadOS and macOS operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the CloudKit component in iPadOS and macOS is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the user interface of Juniper Networks’ Junos OS and Junos OS Evolved systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the user interface of Juniper Networks’ Junos OS and Junos OS Evolved lies in the insufficient protection of operational data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by executing a specific command like “show...

The vulnerability of the SAP Commerce Cloud platform, related to the transmission of critical information in open text, allows attackers to disclose protected information.

The vulnerability of the SAP Commerce Cloud e-commerce platform lies in the transmission of critical information in plaintext. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

The vulnerability of the SAP KMC WPC knowledge management business application, related to deficiencies in the authentication process, allows unauthorized users to gain unauthorized access to protected information.

The vulnerability of the SAP KMC WPC knowledge management business application is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the OData protocol implementation in SAP S4CORE Entity software allows unauthorized access to protected information.

The vulnerability of the OData protocol implementation in SAP S4CORE Entity software is related to deficiencies in displaying hidden user fields. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the favicon.ico component of the SafeInspect system for controlling privileged users allows a violator to disclose protected information.

The vulnerability of the favicon.ico component in the SafeInspect privilege management system is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose protected information through a specially crafted GET...

The vulnerability of the pgCodeKeeper plugin for the PostgreSQL database, which involves unencrypted storage of critical information, allows a hacker to disclose the protected data.

The vulnerability of the pgCodeKeeper plugin for the PostgreSQL database is related to the unencrypted storage of critical information. Exploiting this vulnerability could allow an attacker to disclose the protected data...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials through the TokenReview API and PolicyBinding resource. An attacker can escalate privileges and potentially access sensitive data by exploiting the improper validation of service account tokens and...

SUSE CVE-2025-22072

In the Linux kernel, the following vulnerability has been resolved: spufs: fix gang directory lifetimes prior to "POWERPC spufs: Fix gang destroy leaks" we used to have a problem with gang lifetimes - creation of a gang returns opened gang directory, which normally gets removed when that gets...

OESA-2025-1443 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Par...