BIT-ELASTICSEARCH-2025-37727 Elasticsearch Insertion of sensitive information in log file

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex...

CVE-2025-10732

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint...

CVE-2025-10732 SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint...

CVE-2025-10732 SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint...

Liferay has Incorrect Permission Assignment for Critical Resource

Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display Widget. This security flaw could result in...

PT-2025-41993

Name of the Vulnerable Software and Affected Versions Microsoft Windows Failover Cluster affected versions not specified Description A flaw exists in Windows Failover Cluster that allows an authorized attacker to disclose sensitive information locally through the insertion of this information int...

Microsoft Windows Failover Cluster 日志信息泄露漏洞

The Microsoft Windows Failover Cluster is a group of independent computers from Microsoft Corporation USA that work together to improve the availability and scalability of cluster roles formerly known as clustered applications and services. A log information disclosure vulnerability exists in...

Microsoft Windows USB Video Class driver 安全漏洞

Microsoft Windows USB Video Class driver is a driver for webcams or digital camcorders from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows USB Video Class driver, which can be exploited by attackers to obtain sensitive information...

PT-2025-42019

Name of the Vulnerable Software and Affected Versions Windows Kernel affected versions not specified Description A security feature bypass is possible locally due to the cleartext storage of sensitive information within the Windows Kernel. An unauthorized attacker could exploit this condition...

PT-2025-41848

Name of the Vulnerable Software and Affected Versions SureForms – Drag and Drop Form Builder for WordPress versions prior to 1.12.2 Description The SureForms – Drag and Drop Form Builder for WordPress plugin contains a flaw in access control. Specifically, the...

PT-2025-42089

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description An issue exists where sensitive information is inserted into a log file within the Windows ETL Channel. This allows an authorized attacker to disclose information locally. Recommendations At...

Microsoft Windows Failover Cluster 信息泄露漏洞

The Microsoft Windows Failover Cluster is a group of independent computers from Microsoft Corporation USA that work together to improve the availability and scalability of cluster roles formerly known as clustered applications and services. An information disclosure vulnerability exists in...

Fortinet FortiWeb Insertion of Sensitive Information Into Sent Data in csfd daemon (FG-IR-24-228)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-228 advisory. - A insertion of sensitive information into sent data in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiVoice 7.0.0...

PT-2025-42080

Name of the Vulnerable Software and Affected Versions Windows Failover Cluster affected versions not specified Description An issue exists in Windows Failover Cluster that allows an authorized attacker to disclose information locally. The issue involves the exposure of sensitive information to an...

PT-2025-42076

Name of the Vulnerable Software and Affected Versions Windows High Availability Services affected versions not specified Description An issue exists in Windows High Availability Services that allows an authorized attacker to disclose information locally. The issue involves the exposure of sensiti...

PT-2025-42095

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description An issue exists in the Windows StateRepository API where sensitive information is inserted into log files. This allows an authorized attacker to disclose information locally. Recommendations ...

Microsoft Windows Failover Cluster 信息泄露漏洞

The Microsoft Windows Failover Cluster is a group of independent computers from Microsoft Corporation USA that work together to improve the availability and scalability of cluster roles formerly known as clustered applications and services. An information disclosure vulnerability exists in...

PT-2025-42137

Name of the Vulnerable Software and Affected Versions Microsoft Failover Cluster Virtual Driver affected versions not specified Description An issue exists in Microsoft Failover Cluster Virtual Driver that allows an authorized attacker to disclose information locally. The issue involves the...

PT-2025-41911

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A Stored Cross-Site Scripting issue exists that could allow a malicious user to view and modify sensitive data or make the webpage unavailable. The issue is due...

Microsoft Windows Cryptographic Services 安全漏洞

Microsoft Windows Cryptographic Services is a cryptographic service provider program from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Cryptographic Services, which can be exploited by an attacker to obtain sensitive information...