12949 matches found
EUVD-2025-198558
Malicious code in instacart-ui npm...
CVE-2025-13357 Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method
Vault’s Terraform Provider incorrectly set the default denynullbind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. Thi...
CVE-2025-41115 Incorrect privilege assignment
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user...
Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method
Summary Vault’s Terraform Provider incorrectly set the default denynullbind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication...
EUVD-2025-198361
IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system...
The vulnerability of the WebGPU API interface in Mozilla Firefox and the Thunderbird email client allows attackers to bypass the sandbox protection mechanisms and compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the WebGPU API interface in Mozilla Firefox and the Thunderbird email client is related to incorrect handling of exceptional states. Exploiting this vulnerability can allow an attacker to bypass the sandboxing mechanisms and compromise the confidentiality, integrity, and...
PT-2025-47240
Observable Timing Discrepancy CWE-208 in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a distributed in 9.30.2881 MR3, 9.2...
Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-42105)
nilfs2: use-after-free. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504674; scriptversion"1.3";...
CVE-2025-36299
IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system...
EUVD-2025-197815
QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login page. Because the account provides administrative privileges in the default configuration, an attacker who can reach the login page can ga...
CVE-2024-21635
Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their account has been compromised, they can update the...
EUVD-2025-177620
Malicious code in nextjs-event-chromedriver-pm2 npm...
EUVD-2025-176116
Malicious code in supernova-apex-brane-callback npm...
EUVD-2025-178428
Malicious code in index-short-java-phi-virtualize npm...
EUVD-2025-179098
Malicious code in epimetheus-release-it-fetch-centaurus npm...
EUVD-2025-179142
Malicious code in encode-rain-refactor-execute-pi npm...
EUVD-2025-178997
Malicious code in exec-antimatter-jovian-postgres npm...
EUVD-2025-175421
Malicious code in zenobia-rate-limiter-cosmos-csrf npm...