共收录 7 条相关安全情报。
← 返回所有主题Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances (SV-100E and SV-300E series) and Synergis Softwire installed on Windows servers.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker with physical access to the system disk can recover this information and craft an environment to unseal the TPM.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Domain may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and r
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed). A repository-wi
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history). Impact: Any actor able to bypass the app sandbox can read these databases in p
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover. The API dynamically leaks the active session's authentication tokens (including the `jwt`, `user_toke
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
CVE-2026-7257 是 Zyxel WRE6505 v2 无线路由器/扩展器固件版本 V1.00(ABDV.3)C0 中的一个漏洞。该漏洞被标记为“UNSUPPORTED WHEN ASSIGNED”，意味着该产品已停止支持，不再接收安全更新。漏洞类型为敏感信息的不安全存储，位于设备的配置文件中。具有管理员权限的本地攻击者可以利用此漏洞下载并解密备份配置文件，从而获取包括密码、密钥等在内的敏感配置信息。CVSS 评分为 4.4（中等），攻击向量为本地，攻击复杂度低，需要高权限，影响机密性（高），不影响完整性和可用性。由于产品已停止支持，厂商不会发布补丁。建议用户立即停止使用该设备或升级到受支持的新型号。已确认未列入 CISA KEV 目录，且未有在野利用报告。
💡 影响/原因: Zyxel WRE6505 v2 已停止支持，该漏洞可导致管理员权限下的敏感配置泄露，且无法修复，替换设备是唯一有效的缓解措施。