CVE-2025-25042 Authenticated Access Control Vulnerability allows Sensitive Information Disclosure in AOS-CX REST Interface

A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on the switch, potentially leading to further unauthorized acce...

CVE-2025-25042 Authenticated Access Control Vulnerability allows Sensitive Information Disclosure in AOS-CX REST Interface

A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on the switch, potentially leading to further unauthorized acce...

CVE-2025-25042

CVE-2025-25042 affects HPE AOS-CX devices via the REST interface. An authenticated, low-privilege user can read encrypted credentials of other users on the switch, exposing sensitive information and potentially enabling further access. The CVSS v3.1 base score is 4.3 (Medium) with network attack ...

ABB RMC-100

SUMMARY An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop. 2. WORKAROUNDS The vulnerability is only present when the REST interface is enabled...

WordPress plugin REST API TO MiniProgram 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Cleartext Storage of Sensitive Information

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information due to improper redaction of encrypted values in config.xml when accessed via REST API or CLI. An attacker with...

CVE-2025-27623

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets...

CVE-2024-24778

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management due to improper privilege management in a REST interface. An attacker can access unauthorized resources by knowing the resource ID. Note: This is only exploitable if the attacker is a registered user...

GHSA-VM7W-2724-5M23 Apache StreamPipes has improper privilege management in a REST interface

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was known. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

Apache StreamPipes has improper privilege management in a REST interface

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was known. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

PYSEC-2025-66

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1.Users are recommended to upgrade to version 0.97.0 which fixes the issue...

CVE-2024-24778

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

PYSEC-2025-66

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

CVE-2024-24778

CVE-2024-24778 – Apache StreamPipes" : Applies to StreamPipes up to version 0.95.1. Root cause described across sources as improper privilege management in a REST interface, due to lack of filtering/sloppy validation of resource IDs, allowing registered users to access unauthorized resources if t...

PT-2025-9316 · Apache · Apache Streampipes

Name of the Vulnerable Software and Affected Versions: Apache StreamPipes versions through 0.95.1 Description: The issue is related to improper privilege management in a REST interface, allowing registered users to access unauthorized resources if the resource ID is known. Recommendations: Upgrad...

CVE-2023-26566

Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface ARI, which allows remote attackers to reconfigure Asterisk and make external and internal calls via HTTP and WebSocket requests sent to the API...

PT-2025-6495 · WordPress · Brizy

Name of the Vulnerable Software and Affected Versions: Brizy – Page Builder plugin for WordPress versions up to and including 2.6.8 Description: The issue is related to Stored Cross-Site Scripting via REST API SVG File uploads due to insufficient input sanitization and output escaping. This allow...

WordPress plugin Hunk Companion 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability in...

WordPress WP Project Manager plugin <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API vulnerability

Authenticated Subscriber+ Sensitive Information Exposure via Project Task List REST API vulnerability discovered by Noah Stead TurtleBurg in WordPress Plugin WP Project Manager versions = 2.6.15...