CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
TeleMessage JSP Application Heap Dump Credential Exposure Vulnerability (CVE-2025-48928) Analysis and Mitigation Guide
[Affected Scope] TeleMessage services and associated JSP applications through 2025-05-05
[Impact] Local attackers can extract plaintext passwords and sensitive credentials previously transmitted over HTTP by analyzing memory heap dumps
[Mitigation] Apply the latest security patches, restrict access to heap dump files, and optimize JVM garbage collection to prevent sensitive data from persisting in memory
TeleMessage Service Spring Boot Actuator Heap Dump (/heapdump) Exposure Information Disclosure Vulnerability (CVE-2025-48927)
[Affected Scope] TeleMessage service deployments through 2025-05-05
[Impact] Unauthenticated remote attackers can download the JVM heap dump via the exposed /heapdump endpoint, leading to the extraction of sensitive credentials, API keys, and user data from memory
[Mitigation] Disable the heapdump Actuator endpoint immediately, restrict external access via reverse proxies/WAFs, and rotate all potentially compromised credentials