Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log

Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causi...

Last-Level Cache Attack

AMD ID: AMD-SB-7032 Potential Impact: N/A Severity: N/A Summary Researchers from Wuhan University have provided AMD with a paper titled “ZenLeak: Practical Last-Level Cache Side-Channel Attacks on AMD Zen Processors” in which they discuss prime and probe attacks targeting the Last-Level Cache LLC...

CVE-2024-42450

The Versa Director uses PostgreSQL Postgres to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default configuration has a common password across all instances of Versa Director. By default, Versa Director configures Postgres t...

CVE-2025-23215

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...

CVE-2025-24783

Apache Cocoon (all versions) is vulnerable to an Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) . The root cause is that the PRNG used to generate continuation identifiers is seeded with the system startup time, making these identifiers insufficiently unpredictable. An attacker...

SpagoBI 3.5.1 Command Injection

SpagoBI versions 3.5.1 and below suffer from a command injection vulnerability. CVE-2024-54794 Severity : Critical 9.1 CVSS score : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Summary : Engineering Ingegneria Informatica SpagoBI version 3.5.1 is affected by Command Injection vulnerability in the...

Exploit for Protection Mechanism Failure in 7-Zip

7-Zip Mark-of-the-Web Bypass Vulnerability CVE-2025-0411 - P...

CVE-2025-21570

...

CVE-2025-21562

CVE-2025-21562 concerns Oracle PeopleSoft PeopleSoft Enterprise CC Common Application Objects (Run Control Management) version 9.2. The vulnerability allows a low-privileged attacker with network access over HTTP to read a subset of data from the affected object, with CVSS 3.1 base score 4.3 (Con...

CVE-2025-21489

CVE-2025-21489 affects Oracle E-Business Suite Advanced Outbound Telephony (Region Mapping) with affected 12.2.3–12.2.10. The vulnerability allows an unauthenticated attacker who can reach Oracle Advanced Outbound Telephony over HTTP to compromise data after user interaction, potentially leading ...

AMD Client UEFI Firmware – SMM Lock Bypass

AMD has informed HP of a potential security vulnerability identified in some AMD client platform firmware components, which might allow arbitrary code execution. AMD has released firmware updates to mitigate these vulnerabilities. AMD has released updates to mitigate this potential vulnerability...

SUSE CVE-2024-45337

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

CVE-2024-11053

A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host. Mitigation Avoid usin...

AZL-54363 CVE-2024-45337 affecting package telegraf for versions less than 1.31.0-3

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

CVE-2024-52067

CVE-2024-52067 affects Apache NiFi 1.16.0–1.28.0 and 2.0.0-M1–2.0.0-M4. The issue is optional debug logging of Parameter Context values during flow synchronization, which an authorized admin could enable to write parameter names and values to logs. Deployments with the default Logback config do n...

CVE-2024-52595 HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through

lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as , and . This behavior deviates from how web browsers parse and interpret such tags...

CVE-2024-52595 HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through

lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as , and . This behavior deviates from how web browsers parse and interpret such tags...

kernel: powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch The RFI and STF security mitigation options can flip the interruptexitnotreentrant static branch condition concurrently with the interrupt exit code...

PT-2024-8025

Name of the Vulnerable Software and Affected Versions: Substance3D - Painter versions 10.1.0 and earlier Description: The issue is related to an out-of-bounds read operation in memory, which could allow an attacker to gain unauthorized access to protected information using a specially crafted fil...

GHSA-87CF-J763-VVH8 OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)

Summary In the database extension, the "enableloadextension" property can be set for the SQLite integration, enabling an attacker to load local or remote extension DLLs and so run arbitrary code on the server. The attacker needs to have network access to the OpenRefine instance. Details The...