CVE-2025-2003

Devolutions Server versions 2024.3.12 and earlier are affected by a vulnerability involving incorrect authorization within PAM vaults . This flaw allows an authenticated user to bypass the 'add in root' permission , potentially enabling the execution of restricted actions. While the documents rec...

PT-2025-9849

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2024.3.12 and earlier Description The issue concerns incorrect authorization in PAM vaults, allowing an authenticated user to bypass the 'add in root' permission. This enables the user to perform actions that would...

CVE-2025-2003: Incorrect Authorization

Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission...

CVE-2024-43779

An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to reading vaults that have been previously disabled, possibly leaking sensitive credentials. An attacker can send a series of HTTP...

Obsidian Plugin Persistence

This module searches for Obsidian vaults for a user, and uploads a malicious community plugin to the vault. The vaults must be opened with community plugins enabled NOT restricted mode, but the plugin will be enabled automatically. Tested against Obsidian 1.7.7 on Kali, Ubuntu 22.04, and Windows...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: nuclei, buildkitd, policy-controller, sigstore-scaffolding, fluent-bit-plugin-loki, grafana-mimir, harbor-registry, flux-kustomize-controller, bank-vaults, hugo, step-ca, kubescape, flux-image-reflector-controller, fulcio, prometheus-operator, restic, rekor, thanos,...

Clearpool Expands to Avalanche with Listed Fintech Firm Launching First Credit Vault

By Uzair Amir Clearpool launches Credit Vaults on Avalanche, offering an on-chain credit solution with real-world asset backing, marking a significant step in bridging traditional finance and DeFi through partnerships with firms like Banxa. This is a post from HackRead.com Read the original post:...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: policy-controller, sigstore-scaffolding, slsa-verifier, dgraph, flux-kustomize-controller, bank-vaults, oauth2-proxy, step-ca, kubescape, apko, kots, skaffold, fulcio, weaviate, rekor, step, dex, tekton-chains, temporal-ui-server, cloudflared, tkn, melange,...

CVE-2023-5358

Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed to access via the report request url query parameters...

Improper access control

Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed to access via the report request url query parameters...

CVE-2023-5358

Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed to access via the report request url query parameters...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: cortex, kubeflow-fips, spark-operator, vault-csi-provider, kubernetes-csi-livenessprobe-fips, up, dynamic-localpv-provisioner-fips, timestamp-authority-fips, metrics-server-fips, conftest-fips, plutono-fips, falcoctl-fips, kiam, kubevela, buildkitd,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: prometheus-mongodb-exporter, pulumi-kubernetes-operator, amass, prometheus-adapter, hey, bank-vaults, prometheus-bind-exporter, flux-notification-controller, kots, vertical-pod-autoscaler, secrets-store-csi-driver, nodetaint, buildkitd, trust-manager, gitness,...

LastPass: ‘Horse Gone Barn Bolted’ is Strong Password

The password manager service LastPass is now forcing some of its users to pick longer master passwords. LastPass says the changes are needed to ensure all customers are protected by their latest security improvements. But critics say the move is little more than a public relations stunt that will...

CVE-2023-41646

Buttercup v2.20.3 allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/...

Buttercup Security Breach

Buttercup is a password manager. A security vulnerability exists in Buttercup version v2.20.3. An attacker can exploit this vulnerability to obtain the hash value of the password manager's master password by accessing the file /vaults.json/...

H-09 Unmitigated

Lines of code Vulnerability details Issue not mitigated About the problem In the report i have described some vaults that will not work in the designed system. Example of such vault will be any vault that has withdraw limit. In this case yieldVault.maxWithdraw call will not return actual amount o...

CVE-2023-4417

Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows allows an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in th...

CVE-2023-4417

Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows allows an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in th...

CVE-2023-4417: Undefined Security Weakness

Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows allows an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in th...