Kanban Module Unauthenticated Access

The vulnerability of the /kanban/ajax component in the Kanban module of the Support Service Management system of FreeScout is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

Microsoft Office Buffer Overflow Info Disclosure

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by these security measures...

CVE-2025-61789 Icinga DB Web hidden/protected custom variables are prone to filter enumeration

Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values...

CVE-2025-61789

Icinga DB Web (before 1.1.4 and 1.2.3) allows an authorized user to use a custom variable in a filter that is protected or hidden to guess its values; versions 1.1.4 and 1.2.3 return an error when such a variable is used. Affected product: Icinga DB Web; root cause: filter-enumeration of hidden/p...

CVE-2025-61789 Icinga DB Web hidden/protected custom variables are prone to filter enumeration

Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values...

CVE-2025-61789 Icinga DB Web hidden/protected custom variables are prone to filter enumeration

Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values...

Icinga DB Web security vulnerabilities

Icinga DB Web is an Icinga open source graphical interface to the Icinga DB database. A security vulnerability exists in Icinga DB Web versions prior to 1.1.4 and prior to 1.2.3, which originates from an authorized user being able to guess the value of a protected or hidden variable via a custom...

Windows Taskbar Live Disclosure

The vulnerability of the Windows Taskbar Live component in operating systems is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker to disclose protected information...

Failover Cluster Disclosure Information

The vulnerability of the Failover Cluster component for Windows operating systems is related to insufficient protection of operational data. Exploiting this vulnerability can allow attackers to disclose the protected information...

Windows Push Notification Service Disclosure

The vulnerability of the Windows Push Notification Service in Windows operating systems is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker to disclose protected information...

TCG TPM2 Buffer Overflow

The vulnerability of the CryptHmacSign function in the TCG TPM2 implementation of the TPM2 Software Stack is related to reading memory beyond the bounds of the allocated buffer. Exploiting this vulnerability could allow an attacker to disclose the protected information...

Trassir Cloud Unauthenticated Access

The vulnerability of the Trassir Cloud cloud-based video surveillance platform is related to inconsistencies in responses to incoming requests. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

SMB Clients Windows Unauthorized Access

The vulnerability of SMB clients of Windows operating systems is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information...

Windows Push Notification Service Disclosure

The vulnerability of the Windows Push Notification Service in Windows operating systems is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker to disclose protected information...

Hidden/Protected custom variables are prone to filter enumeration

Icinga reports: An authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it...

CVE-2025-11701

The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the zacreatezipcallback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to...

CVE-2025-11701

CVE-2025-11701 refers to the WordPress plugin Zip Attachments (versions

CVE-2025-11701 Zip Attachments <= 1.6 - Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosure

The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the zacreatezipcallback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to...

CVE-2025-11701 Zip Attachments <= 1.6 - Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosure

The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the zacreatezipcallback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to...

WordPress Zip Attachments plugin <= 1.6 - Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosure vulnerability

Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosure vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Zip Attachments versions = 1.6...