Missing Encryption of Sensitive Data

Overview Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data via the storage of tokens in plain text within config.xml files. An attacker can gain unauthorized access to sensitive token information by obtaining Item/Extended Read permission or accessing the...

Jenkins Dead Man's Snitch Plugin vulnerability stores tokens in plain text

Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the global configuration form where the Xooa Deployment Token is displayed in plain text. An attacker can obtain sensitive authentication credentials by viewing the configuration form. Remediation...

Unifying Re-Identification, Attribute Inference, and Data Reconstruction Risks in Differential Privacy

Differentially private DP mechanisms are difficult to interpret and calibrate because existing methods for mapping standard privacy parameters to concrete privacy risks -- re-identification, attribute inference, and data reconstruction -- are both overly pessimistic and inconsistent. In this work...

FNKvision FNK-GU2 安全漏洞

FNKvision FNK-GU2 is a camera from FNKvision Thailand. A security vulnerability exists in FNKvision FNK-GU2 version 40.1.7 and earlier, which originates from the /rom/wpasupplicant.conf file storing sensitive information in clear text...

CVE-2025-5537

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versions up to, and including, 2.7.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Malicious code in fe-comp-input-text-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcb443ddf0b8c18bdcbd7dcfbf6b8e3c2a5ba2614ea22acf4310735a82259d51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

webkitgtk: User password may be read aloud by a text-to-speech accessibility feature

A flaw was found in webkitgtk where a user’s password may be read aloud by a text-to-speech accessibility feature...

Marvell QConvergeConsole 路径遍历漏洞

Marvell QConvergeConsole is a cross-data center unified adapter management software from Marvell, Inc. A path traversal vulnerability exists in Marvell QConvergeConsole that stems from the saveAsText method not properly validating a user-supplied path, which could lead to remote code execution...

Simple forum /forum_edit1.php file cross-site scripting vulnerability

Simple forum is a simple forum. Simple forum suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter text in the file /forumedit1.php, which can be exploited by an attacker to execute arbitrary Web scrip...

CVE-2025-53485

SetTranslationHandler.php does not validate that the user is an election admin, allowing any even unauthenticated user to change election-related translation text. While partially broken in newer MediaWiki versions, the check is still missing. This issue affects Mediawiki - SecurePoll extension:...

CVE-2025-49846

wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that were visible in the view port have been logged to the iOS system logs in clear text. Wire application logs created and managed by the application itself were not affected,...

False Alarms, Real Damage: Adversarial Attacks Using LLM-Based Models on Text-Based Cyber Threat Intelligence Systems

Cyber Threat Intelligence CTI has emerged as a vital complementary approach that operates in the early phases of the cyber threat lifecycle. CTI involves collecting, processing, and analyzing threat data to provide a more accurate and rapid understanding of cyber threats. Due to the large volume ...

CVE-2025-53485

SetTranslationHandler.php does not validate that the user is an election admin, allowing any even unauthenticated user to change election-related translation text. While partially broken in newer MediaWiki versions, the check is still missing. This issue affects Mediawiki - SecurePoll extension:...

CVE-2025-53485

The CVE concerns the MediaWiki SecurePoll extension where SetTranslationHandler.php does not validate that the user is an election admin. This allows any (even unauthenticated) user to change election-related translation text. Affects SecurePoll versions: 1.39.X before 1.39.13; 1.42.X before 1.42...

VLAI: a RoBERTa-Based Model for Automated Vulnerability Severity Classification

This paper presents VLAI, a transformer-based model that predicts software vulnerability severity levels directly from text descriptions. Built on RoBERTa, VLAI is fine-tuned on over 600,000 real-world vulnerabilities and achieves over 82% accuracy in predicting severity categories, enabling fast...

CVE-2025-49846

wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that were visible in the view port have been logged to the iOS system logs in clear text. Wire application logs created and managed by the application itself were not affected,...

CVE-2025-49846 wire-ios accidentally logs message contents

wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that were visible in the view port have been logged to the iOS system logs in clear text. Wire application logs created and managed by the application itself were not affected,...

CVE-2025-49846

Summary : CVE-2025-49846 affects the Wire iOS client. For Wire iOS versions 3.111.1–3.124.1, messages visible in the viewport were logged in clear text to the iOS system logs due to canOpenUrl() being called with an invalid URL, with access requiring physical possession of an unlocked device. The...

CVE-2025-49846 wire-ios accidentally logs message contents

wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that were visible in the view port have been logged to the iOS system logs in clear text. Wire application logs created and managed by the application itself were not affected,...