#information-disclosure

[ follow ]
#remote-code-execution #coolify #command-injection #cisco-ise #xml-parsing-flaw #cve-2026-20029
Information security
fromThe Hacker News
2 days ago

Coolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instances

Multiple critical command-injection and information-disclosure vulnerabilities in Coolify allow authenticated or low-privileged users to achieve remote code execution, container escape, and root compromise.
Information security
fromThe Hacker News
2 days ago

Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release

Authenticated administrative users can exploit an XML parsing flaw in Cisco ISE/ISE-PIC licensing to read arbitrary operating-system files.
Information security
fromThe Hacker News
4 weeks ago

New React RSC Vulnerabilities Enable DoS and Source Code Exposure

React Server Components contain vulnerabilities allowing pre-auth DoS and possible Server Function source-code disclosure; update to versions 19.0.3, 19.1.4, or 19.2.3.
fromTryton Discussion
1 month ago

Security Release for issue #14354

Mahdi Afshar and Abdulfatah Abdillahi have found that trytond sends the trace-back to the clients for unexpected errors. This trace-back may leak information about the server setup. Impact CVSS v3.0 Base Score: 4.3 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None Workaround A possible workaround is to configure an error handler which would remove the trace-back from the response. Resolution All affected users should upgrade trytond to the latest version.
Information security
Information security
fromThe Hacker News
2 months ago

ThreatsDay Bulletin: AI Tools in Malware, Botnets, GDI Flaws, Election Attacks & More

Digital vulnerabilities now translate into real-world harm as scams, rented cyber violence, and compromised apps turn digital weaknesses into physical, economic, and political threats.
fromThe Hacker News
4 months ago

Researchers Warn of Sitecore Exploit Chain Linking Cache Poisoning and Remote Code Execution

CVE-2025-53693 - HTML cache poisoning through unsafe reflections CVE-2025-53691 - Remote code execution (RCE) through insecure deserialization CVE-2025-53694 - Information Disclosure in ItemService API with a restricted anonymous user, leading to exposure of cache keys using a brute-force approach Patches for the first two shortcomings were released by Sitecore in June and for the third in July 2025, with the company stating that "successful exploitation of the related vulnerabilities might lead to remote code execution and non-authorized access to information."
Information security
[ Load more ]