JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides features such as continuous unit testing, code quality analysis and build issue analysis reports. A security vulnerability exists in JetBrains TeamCity...

PT-2025-51719

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

Linux Distros Unpatched Vulnerability : CVE-2025-68288

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: storage: Fix memory leak in USB bulk transport A kernel memory leak was identified by the 'ioctlsg01' test from Linux Test Project LTP. The following bytes...

Jenkins Automation Server Information Disclosure

The vulnerability of the Jenkins automation server lies in the way information is stored in an open manner. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the protected information...

Jenkins Automation Server Information Disclosure

The vulnerability of the Jenkins automation server lies in the way information is stored in an open manner. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the protected information...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale System are now fixed in Storage Scale System 6.2.3.3 and 7.0.0.0 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale System could provide weaker-than-expected security, are now fixed in Storage Scale System 6.2.3.3 and 7.0.0.0 or higher CVE-2024-50058, CVE-2024-46697, CVE-2024-43855, CVE-2024-42294, CVE-2024-36930, CVE-2024-42316,...

GHSA-MH85-44C2-3M97 Grav is vulnerable to Stored XSS through authenticated user-edited content

grav before v1.7.49.5 has a Stored Cross-Site Scripting Stored XSS vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious JavaScript payloads into editable fields. The payload is stored on the server and later...

Security Bulletin: Rational Performance Tester contains a vulnerability which could effect its use of the MIME4J library

Summary Due to the use of the MIME4J library, Rational Performance Tester contains a vulnerability that could potentially allow access to sensitive data. Vulnerability Details CVEID:CVE-2022-45787 DESCRIPTION: Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvid...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues were fixed: CVE-2022-50253: bpf: make sure skb-len != 0 when redirecting to a tunneling device bsc1249912. CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in...

EUVD-2025-203310

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

GHSA-R6J8-C6R2-37RR kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

UGREEN DH2100+ 安全漏洞

UGREEN DH2100+ is a private cloud storage device from China Greenlink UGREEN. A security vulnerability exists in UGREEN DH2100+ version 5.3.0 and earlier, which stems from a symbolic link following issue in the USB Handler component...

CVE-2025-66843

Grav, prior to v1.7.49.5, is affected by a Stored XSS in the page editing feature. An authenticated, low-privilege user with edit permissions can inject JavaScript into editable fields; the payload is stored server-side and executed when other users view or edit the affected page. Affected versio...

usb: storage: sddr55: Reject out-of-bound new_pba

...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the kube-controller-manager when using the in-tree Portworx StorageClass. An attacker can access sensitive information from unprotected endpoints within the control plane's host network, including...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the kube-controller-manager when using the in-tree Portworx StorageClass. An attacker can access sensitive information from unprotected endpoints within the control plane's host network, including...

CVE-2025-13281

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

SUSE CVE-2025-40345

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound newpba Discovered by Atuin - Automated Vulnerability Discovery Engine. newpba comes from the status packet returned after each write. A bogus device could report values beyond the block...

Improper Cleanup Of Sensitive Data

Ansible is vulnerable to improper cleanup of sensitive data. The vulnerability is due to the awsssm connection plugin not performing garbage collection after playbook execution, which allows sensitive files to remain in the storage bucket and exposes confidential data to unauthorized access...

Session Fixation

CKAN is vulnerable to Session Fixation. The vulnerability is due to improper session management when server-side session storage is enabled, which allows an attacker to fix or hijack a user’s session by setting or obtaining a valid session identifier...