CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-27625
https://notcve.org/view.php?id=CVE-2025-27625
05 Mar 2025 — In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as part of scheme-relative redirects. • https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3501 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2025-27624
https://notcve.org/view.php?id=CVE-2025-27624
05 Mar 2025 — A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets). • https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3498 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-27623
https://notcve.org/view.php?id=CVE-2025-27623
05 Mar 2025 — Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets. • https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3496 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-27622
https://notcve.org/view.php?id=CVE-2025-27622
05 Mar 2025 — Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets. • https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3495 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.1EPSS: 8%CPEs: 20EXPL: 2CVE-2025-26465 – Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
https://notcve.org/view.php?id=CVE-2025-26465
18 Feb 2025 — A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high. It was discovered that the OpenSSH client incorrectly handled ... • https://github.com/rxerium/CVE-2025-26465 • CWE-390: Detection of Error Condition Without Action •
CVSS: 5.9EPSS: 14%CPEs: 11EXPL: 3CVE-2025-26466 – Openssh: denial-of-service in openssh
https://notcve.org/view.php?id=CVE-2025-26466
18 Feb 2025 — A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack. • https://github.com/rxerium/CVE-2025-26466 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.1EPSS: 84%CPEs: 14EXPL: 4CVE-2025-1094 – PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
https://notcve.org/view.php?id=CVE-2025-1094
13 Feb 2025 — Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command li... • https://packetstorm.news/files/id/189316 • CWE-149: Improper Neutralization of Quoting Syntax •
CVSS: 5.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31068 – Ubuntu Security Notice USN-7269-1
https://notcve.org/view.php?id=CVE-2024-31068
12 Feb 2025 — Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial of service via local access. Ke Sun, Paul Grosen and Alyssa Milburn discovered that some Intel® Processors did not properly implement Finite State Machines in Hardware Logic. A local privileged attacker could use this issue to cause a denial of service. It was discovered that some Intel® Processors with Intel® SGX did not properly restrict access to the EDECCSSA user le... • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01166.html • CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36293 – Ubuntu Security Notice USN-7269-1
https://notcve.org/view.php?id=CVE-2024-36293
12 Feb 2025 — Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access. Ke Sun, Paul Grosen and Alyssa Milburn discovered that some Intel® Processors did not properly implement Finite State Machines in Hardware Logic. A local privileged attacker could use this issue to cause a denial of service. It was discovered that some Intel® Processors with Intel® SGX did not properly restrict acc... • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01213.html • CWE-284: Improper Access Control •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37020
https://notcve.org/view.php?id=CVE-2024-37020
12 Feb 2025 — Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable denial of service via local access. • https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01194.html • CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior •