Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 151.0.7922.72 permits remote attackers to inject arbitrary scripts or HTML that execute across same-origin boundaries within the victim's browser session. The CVSS Scope:Changed metric confirms the cross-origin breakout characteristic of UXSS - distinguishing this from ordinary reflected XSS by targeting browser internals rather than a web application. No public exploit has been identified at time of analysis, and an EPSS score of 0.17% (7th percentile) indicates low current exploitation probability; vendor patch is confirmed available at 151.0.7922.72.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Network component allows remote attackers to inject arbitrary scripts or HTML across same-origin policy boundaries via a crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. Unlike application-level XSS, UXSS exploits a flaw in the browser engine itself, enabling cross-origin script execution that bypasses website-level security controls. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), but the confirmed scope change (S:C in CVSS) signals genuine cross-origin impact potential.
DOM-based Cross-Site Scripting in CleverTap Web SDK v1.15.1 allows an attacker to execute arbitrary JavaScript in a victim's browser by sending a crafted message via the window.postMessage API. The SDK's renderCustomHtml function processes postMessage payloads without sanitization before injecting them into the page DOM, enabling script injection in the context of any hosting site that integrates this SDK. No public exploit confirmed at time of analysis; EPSS is very low (0.16%, 6th percentile), and this vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in IBM Engineering Requirements Management DOORS Web Access allows unauthenticated remote attackers to inject arbitrary JavaScript into the Web UI by tricking an authenticated user into interacting with a malicious payload, potentially resulting in credential disclosure within a trusted session. Affected versions span two maintained branches: 9.7.2.1-9.7.2.11 and 9.6.1.1-9.6.1.13. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, and IBM has released a patch via advisory 7279145.
Cross-Site Request Forgery in Apache Zeppelin 0.6.0 through 0.12.0 allows an attacker who lures an authenticated user to a malicious webpage to perform unauthorized actions across the full REST API and WebSocket endpoint surface on the victim's behalf. The vulnerability stems from a permissive default CORS configuration combined with server-side acceptance of text/plain request bodies - a combination that bypasses standard browser preflight CSRF defenses without requiring any special exploit code. No public exploit or CISA KEV listing has been identified; the vendor rates this moderate and has released a patch in version 0.12.1.
Reflected cross-site scripting in Ecommerce Fruits Bazar 1.0 allows a remote unauthenticated attacker to inject malicious JavaScript into the admin panel via the admin/edit_product.php endpoint, with execution occurring in the context of an authenticated administrator's browser session. The scope-changed CVSS vector (S:C) confirms the payload escapes the server's security context into the victim browser, enabling session hijacking or credential theft against administrative users. A proof-of-concept exists in the TaintRadar vulnerability research repository; EPSS is 0.14% (4th percentile), indicating no widespread automated exploitation observed to date.
Reflected Cross-Site Scripting in code-projects Blood System 1.0 allows unauthenticated remote attackers to inject and execute malicious JavaScript in victims' browsers via the unsanitized city parameter in /don.php. The CVSS Changed scope (S:C) confirms the script executes outside the vulnerable application's origin, enabling session hijacking, credential theft, or malicious redirection against authenticated users who can be socially engineered into following a crafted link. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) reflects extremely low exploitation interest, consistent with this product's negligible production footprint.
Cross-buffer memory aliasing in msgpack-ruby prior to 1.8.2 allows same-process code to read or corrupt data belonging to a separate MessagePack::Buffer instance via a use-after-free in the rmem slab allocator. MessagePack::Buffer#clear returns a 4 KiB rmem page to the shared pool but leaves rmem_last, rmem_end, and rmem_owner pointing into the freed page; a subsequent write on the cleared buffer and a concurrent second Buffer allocation can claim the same physical page, creating a memory alias that exposes the second buffer's serialized bytes. A PoC is included in the vendor advisory (GHSA-4mrv-5p47-p938); no public exploit identified at time of analysis beyond that PoC, and the CVE is not in CISA KEV.
Sandbox escape in Google Chrome on Android (versions prior to 151.0.7922.72) stems from a cryptographic flaw in the WebAppInstalls component, exploitable by a local attacker via a crafted HTML page. The CVSS scope change (S:C) confirms the exploit crosses Chrome's sandbox security boundary, enabling impact on resources outside the browser process. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS is extremely low at 0.12% (2nd percentile), indicating minimal observed exploitation pressure.
Unauthenticated exposure of Go pprof debug endpoints in Calico kube-controllers and Goldmane components allows any pod with adjacent network access to retrieve sensitive in-memory data when the shared debug server feature is enabled. Affected products span Calico, Calico Enterprise, and Calico Cloud across all versions per CPE. The vulnerability is opt-in (debug server disabled by default), but carries high confidentiality impact when enabled because heap dumps and goroutine stacks may contain credentials, tokens, or other sensitive runtime state. No public exploit identified at time of analysis and no CISA KEV listing.
Missing brute-force protection on the DFIR-IRIS web application's authentication endpoint exposes version 2.4.26 (and potentially earlier releases) to unlimited credential-stuffing and password-spraying attacks. Unauthenticated remote attackers can submit an unbounded number of login attempts without triggering rate limiting or account lockout, making weak or reused credentials trivially recoverable. DFIR-IRIS is an incident response platform handling sensitive case data, forensic artifacts, and investigation timelines - successful account compromise gives attackers direct access to that material. No public exploit has been identified at time of analysis, and KEV status is not confirmed.
Missing rate-limiting on MFA validation in DFIR-IRIS 2.4.26 allows a remote attacker who possesses valid user credentials to systematically enumerate multi-factor authentication codes until the correct value is found, bypassing the second authentication factor and gaining unauthorized access to the DFIR investigation platform. The CVSS vector scores High confidentiality impact with no integrity or availability penalty, reflecting full read access to sensitive incident response and forensic investigation data. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Relative path traversal in Apache Tika's ISA-Tab parser (ISArchiveParser) enables arbitrary local file read against the Tika process. Specifically, the 'Study Assay File Name' field within an ISA-Tab investigation file is processed without adequate path sanitization, allowing traversal outside the intended dataset directory and causing the contents of any file readable by the Tika process to be emitted in the extracted text output. Affected deployments span Apache Tika 1.8 through 3.3.1 and the 4.0.0-alpha-1 preview release, all of which include the vulnerable tika-parser-scientific-module. No public exploit or CISA KEV listing was identified at time of analysis, but the vulnerability was independently reported by two researchers with proposed patches, indicating the issue is reproducible and well-understood.
Policy bypass in Chrome's Receiver component enables sandbox escape for attackers who have already compromised the renderer process, affecting all Google Chrome versions prior to 151.0.7922.72 on desktop platforms. Exploitation requires chaining a separate renderer compromise vulnerability with this Receiver policy bypass, triggered via a crafted HTML page with user interaction, allowing the attacker to escape Chrome's sandbox boundary and execute code at the OS process level. No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) and SSVC exploitation status of 'none' indicate low current exploitation probability.
Out-of-bounds read in the Media component of Google Chrome on macOS enables sandbox escape for attackers who have already compromised the renderer process. Affected versions are all Chrome for Mac builds prior to 151.0.7922.72; the vendor has released a patched build. No public exploit is identified at time of analysis and EPSS is very low (0.21%, 11th percentile), but the Scope:Changed CVSS metric confirms this crosses Chrome's renderer sandbox boundary - a high-value primitive in multi-stage exploit chains targeting macOS users.
Use-after-free in the GPU process on macOS enables sandbox escape in Google Chrome versions prior to 151.0.7922.72, but only when an attacker has already achieved renderer process compromise. This is a second-stage exploit primitive - it extends an existing renderer compromise across the sandbox boundary into the GPU process, potentially allowing arbitrary code execution outside Chrome's sandbox on macOS. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; however, sandbox escapes are a critical capability for attackers chaining browser exploit kits.
Sandbox escape potential in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, requiring an attacker to have already compromised the renderer process. By delivering a crafted HTML page to a victim with a pre-compromised renderer, an attacker can trigger a Skia out-of-bounds read to break the Chrome sandbox boundary and escalate access beyond the renderer's isolation. No public exploit or KEV listing is identified at time of analysis; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the elevated attack chain complexity.
Sandbox escape in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a specially crafted HTML page. Affected versions are all Chrome releases on Android prior to 151.0.7922.72. This is a chained attack: the flaw alone is insufficient - exploitation requires a prior, separate renderer compromise, which substantially raises the real-world exploitation bar. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; EPSS sits at a low 0.21%.
Sandbox escape in Google Chrome for Android (prior to 151.0.7922.72) stems from a type confusion flaw (CWE-843) in the Tab component, enabling an attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a crafted HTML page. This is a second-stage exploit primitive requiring renderer pre-compromise, reflected in the AC:H and S:C CVSS metrics. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.20% (10th percentile), consistent with a chained, complex attack rather than opportunistic mass exploitation. Patch is available as Chrome 151.0.7922.72.
Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. When the InMemory database backend is in use, the response body returned by internal services is exposed to the attacker through ACME challenge error messages, compounding the confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Sandbox escape in Google Chrome's Updater component on macOS (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to break out of Chrome's security boundary via a crafted HTML page. The CVSS scope-change metric (S:C) confirms the exploit elevates impact beyond the sandboxed renderer into a higher-privilege Updater context. No public exploit code has been identified and EPSS stands at 0.18% (8th percentile), reflecting the high prerequisite barrier of requiring prior renderer compromise; however, the Mac-specific Updater's elevated privilege position makes this a meaningful chained-exploit risk in targeted macOS campaigns.
Sandbox escape in Google Chrome's ANGLE graphics layer on Android enables an attacker who has already compromised the renderer process to break out of the Chrome sandbox via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. This is a second-stage exploit primitive requiring a prior renderer compromise; no public exploit code exists and SSVC reports exploitation as none, keeping real-world risk moderate despite the scope-change nature of the flaw.
Sandbox escape in Google Chrome DevTools prior to version 151.0.7922.72 requires a pre-compromised renderer process and user interaction with a crafted HTML page to break out of the browser sandbox. The root cause is insufficient input validation (CWE-20) in the DevTools component, where attacker-controlled input from the renderer is not properly sanitized before being processed. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.18%, indicating low observed exploitation pressure despite the meaningful impact of a successful sandbox escape.
Sandbox escape in Google Chrome's Printing component on Windows enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on Windows. No public exploit has been identified, EPSS sits at the 7th percentile (0.17%), CISA SSVC rates exploitation as none and the attack as non-automatable, making this a low-urgency patching item despite the sandbox-escape classification.
Sandbox escape in Google Chrome's Bluetooth component (all versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of Chrome's sandbox by sending crafted Bluetooth IPC messages triggered via a malicious HTML page. This is a second-stage, chained exploit - not a standalone remote attack - requiring prior renderer compromise as a hard prerequisite, which is why Chromium rates it Low severity internally despite the sandbox escape classification. No public exploit code or CISA KEV listing has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability consistent with the high attack chain complexity.
Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) enables an attacker who has already achieved renderer-process compromise to break out of Chrome's sandbox via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Extensions subsystem, with a CVSS Scope:Changed rating confirming the impact extends beyond the browser process to the host OS. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), consistent with absence from CISA KEV - but the sandbox escape class carries disproportionate risk relative to its 5.8 base score because it enables full host-level code execution when chained with a renderer RCE.
Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The CVSS Scope:Changed metric confirms this is a true sandbox escape, elevating impact beyond the renderer isolation boundary. No public exploit code exists and EPSS stands at 0.17% (7th percentile), reflecting the chained, high-complexity nature of the attack. Google has released a patched stable channel build (151.0.7922.72).
Credential exposure in Phoenix Contact CHARX SEC EV charging controllers allows a low-privileged local attacker who can read log files to extract plaintext credentials for the built-in 'user-app' account and subsequently authenticate via SSH. Affected are all CHARX SEC-3000, 3050, 3100, and 3150 units running firmware versions 1.0.0 through 1.9.0. Successful exploitation can interrupt active EV charging sessions, constituting a high availability impact in operational charging infrastructure. No public exploit or active exploitation has been identified at time of analysis.
Denial of service in IBM Db2 federated server (versions 12.1.0 through 12.1.4) can be triggered by executing non-fenced federated queries, causing the database engine to exhaust resources and become unresponsive. The root cause is CWE-400 (Uncontrolled Resource Consumption) within the in-process federated wrapper execution path. No public exploit has been identified at time of analysis, and IBM has released a patch via their support portal.
Information disclosure in the Views UI component of Google Chrome on macOS allows a local attacker to read potentially sensitive data from browser process memory by inducing a user to open a crafted HTML page on versions prior to 151.0.7922.72. The flaw is Mac-platform-specific, categorized by Chromium itself as Low severity, and carries no integrity or availability impact. No public exploit exists and no active exploitation has been identified; EPSS probability sits at 0.11% (2nd percentile) and CISA SSVC classifies exploitation as none.
Use-after-free in Chrome's DataTransfer component on Windows exposes process memory to local attackers who can deliver a crafted HTML page to a victim. The flaw affects all Chrome versions on Windows prior to 151.0.7922.72 and results in high-confidence confidentiality loss with no integrity or availability impact. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with CISA SSVC classifying exploitation as 'none' and technical impact as 'partial' - making this a low operational priority despite the High confidentiality CVSS sub-score.
Insecure file permissions in ansible-collection-redhat-leapp expose PostgreSQL backup archives to local non-root users on managed RHEL 9 and RHEL 10 nodes. When the `leapp_old_postgresql_data` remediation option is invoked with elevated privileges, the resulting backup archive is written with world-readable or group-readable permissions (CWE-732), allowing any local non-root user on that managed node to extract the full contents of the archived PostgreSQL data. No public exploit has been identified at time of analysis, and exploitation requires local authenticated access to the managed node.
XML External Entity injection in IBM DataPower Gateway 10.5.0, 10.6.0, and 10.6CD allows a privileged authenticated user who can submit XML data to the gateway to either exfiltrate sensitive information from the underlying system or trigger memory exhaustion through recursive or large entity expansion. The vulnerability exists in the gateway's XML processing pipeline, a core function of this API/ESB platform. No public exploit code has been identified at time of analysis, and the vendor has released a patch documented in IBM Security Advisory 7278748.
Site Isolation bypass in Google Chrome prior to 151.0.7922.72 allows a remote unauthenticated attacker to circumvent the browser's cross-origin process isolation boundary by luring a user to a specially crafted HTML page. The flaw produces partial confidentiality loss - limited cross-origin data exposure - with no integrity impact and constrained scope (S:U per CVSS). No public exploit code exists, CISA SSVC confirms exploitation status as 'none,' and EPSS sits at 0.22% (13th percentile), collectively indicating low near-term exploitation probability despite the ubiquitous deployment footprint of Chrome.
UI spoofing in Google Chrome for iOS (versions prior to 151.0.7922.72) enables remote attackers to misrepresent browser interface elements through specially crafted HTML pages, potentially deceiving users into disclosing information or taking unintended actions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-deliverable exploitation requiring only user interaction with no attacker privileges needed. EPSS at 0.21% (11th percentile), no CISA KEV listing, and Chromium's own internal 'Low' severity rating all converge on low real-world exploitation pressure; no public exploit identified at time of analysis.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Autofill subsystem prior to version 151.0.7922.72 allows a remote unauthenticated attacker to inject arbitrary scripts or HTML that can escape the browser's same-origin policy by delivering a crafted HTML page to an unsuspecting victim. All Chrome installations below 151.0.7922.72 across supported platforms are affected, with partial confidentiality and integrity impact. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; EPSS at 0.20% (11th percentile) and SSVC exploitation status of 'none' confirm low current exploitation probability, though UXSS primitives carry disproportionate value for credential and session theft.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Extensions subsystem, affecting all versions prior to 151.0.7922.72, allows a remote unauthenticated attacker to inject arbitrary scripts or HTML into the browser context by luring a user to a crafted HTML page. The inappropriate implementation in the Extensions component bypasses Chrome's normal script isolation boundaries, potentially enabling cross-origin script execution characteristic of UXSS class flaws. Vendor-confirmed fix is available in Chrome 151.0.7922.72; EPSS of 0.20% (11th percentile) and absence of KEV listing indicate limited active exploitation at time of analysis.
Safe Browsing in Google Chrome prior to 151.0.7922.72 fails to adequately validate untrusted input from a malicious file, allowing a remote attacker to bypass discretionary access control within the browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms unauthenticated network delivery is viable but requires user interaction with the malicious file, limiting both automation and stealth. EPSS at 0.20% (11th percentile) and SSVC exploitation status of 'none' align with the absence of any public exploit or KEV listing, placing this firmly in a patch-and-monitor posture rather than an emergency response.
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML across origin boundaries via crafted malicious network traffic, requiring only passive user interaction such as visiting a compromised page. The vulnerability stems from insufficient input validation (CWE-20) in the iOS-specific Chrome codebase, which uses Apple's WebKit engine rather than Blink. No public exploit code has been identified and CISA KEV does not list this vulnerability; EPSS probability sits at 0.19%, placing it in the 9th percentile of exploitation likelihood.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. No public exploit code or active exploitation (CISA KEV) has been identified; vendor patch is available at version 151.0.7922.72.
UI spoofing in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker to mislead users about the origin or security context of displayed content via a crafted HTML page. Classified by Chromium as Low severity and rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could be leveraged to facilitate phishing or social engineering by making malicious content visually indistinguishable from trusted interfaces. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating this is a routine patch-cycle issue rather than an active threat.
UI spoofing via the DigitalCredentials API in Google Chrome prior to 151.0.7922.72 allows a remote, unauthenticated attacker to deceive users about the legitimacy or origin of credential-related dialogs through a crafted HTML page. The vulnerability stems from an inappropriate implementation in Chrome's handling of the DigitalCredentials web API (CWE-451), enabling misrepresentation of critical UI information. No active exploitation is confirmed (no CISA KEV listing), and with an EPSS score of 0.17% at the 7th percentile, real-world exploitation probability is currently very low.
Stack exhaustion in PHP's phar archive handler allows an attacker to crash the PHP process by supplying a crafted archive containing circular symbolic links, triggering unbounded recursion that depletes the native C stack. Affected versions span PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9 across all platforms. Exploitation requires a PHP process to actively parse the malicious archive (UI:A/AV:L); no public exploit has been identified and exploitation likelihood is rated unlikely (E:U in the provided CVSS 4.0 vector), making this a moderate-priority patch for most deployments - with heightened urgency for applications that process user-supplied phar archives.
Cross-site scripting in IBM Sterling B2B Integrator and Sterling File Gateway 6.2.2.0-6.2.2.0_1 enables any authenticated low-privilege user to inject persistent JavaScript into the Web UI, which executes within the browser session of other authenticated users who load the affected page. The changed scope (S:C in CVSS) reflects that the injected script runs in the victim's browser context rather than the originating user's, enabling credential harvesting or session token theft within the trusted application session. No public exploit code or CISA KEV listing exists at time of analysis; IBM has issued a patch.
Cross-site scripting in the Ebics server component of IBM Sterling B2B Integrator and IBM Sterling File Gateway allows authenticated low-privileged users to inject arbitrary JavaScript into the Web UI, executing in the browser context of other users within a trusted session. Both products across four version branches (6.1.2.x, 6.2.0.x, 6.2.1.x, and 6.2.2.0) are affected, with the primary risk being credential disclosure or session hijacking of higher-privileged users including administrators. IBM has released a patch; no public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in the Administrative Console of IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server allows an authenticated low-privileged user to inject malicious JavaScript that executes in the browser of other users who view the affected console page. The CVSS scope change (S:C) confirms the attack crosses security boundaries, enabling impact on sessions belonging to higher-privileged administrators. No active exploitation has been identified; no public POC is known at time of analysis.
Insufficient policy enforcement in the Chromecast component of Google Chrome prior to 151.0.7922.72 enables an adjacent-network attacker to inject malicious scripts or HTML into a privileged browser page by sending crafted network traffic on the local network segment. The flaw is classified CWE-79 (Cross-Site Scripting), meaning attacker-controlled content executes in a privileged Chrome page context without requiring authentication or victim interaction. No public exploit code has been identified and EPSS is extremely low at 0.11% (2nd percentile), consistent with Chromium's own Low severity rating; a vendor patch is available.
Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.
Path traversal in the Performance Co-Pilot (PCP) pmproxy logger servlet on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 permits unauthenticated remote attackers to create arbitrary files and directories on the host filesystem by supplying a crafted hostname value in requests to the service. The primitive is write-only - no file contents can be read - but an attacker can abuse it to corrupt directory structures or exhaust disk space, leading to denial of service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.