Full Disclosure mailing list archives

UPDATE:




Following the publication of these vulnerabilities and the subsequent CVE
assignments, the CVE identifiers have now been revoked.




The vendor (EQS Group) contacted the CVE Program (via a CNA) and disputed the
records, stating that the affected product is an exclusively hosted SaaS
platform with no customer-managed deployment or versioning. Based on this
argument, the CVE Program concluded that CVE assignment is “not a suitable
solution for vulnerability identification” in this case, as customers do not
take direct action to apply fixes.




In other words, because the service is centrally hosted and patched at the
provider’s discretion, the vulnerabilities are no longer considered eligible for
CVE tracking, despite being real, independently discovered, responsibly
disclosed, and acknowledged by the vendor.

The vendor has stated that fixes are being implemented and that private customer
notifications will be issued internally.




While remediation is of course welcome, this outcome highlights a broader issue:
vulnerabilities in SaaS platforms can effectively disappear from public
vulnerability tracking, simply because the deployment model removes user agency,
a model that arguably incentivizes security through obscurity, rather than
transparency.




The technical findings remain valid.




This update is shared purely for accuracy and record-keeping.

On Sun, Jan 4, 2026 at 4:40 PM <yuffie.kisaragi () atomicmail io
[yuffie.kisaragi () atomicmail io]> wrote:

UPDATE:


The reported vulnerabilities have now been assigned CVE identifiers:
CVE-2025-34411: https://www.cve.org/cverecord?id=CVE-2025-34411
[https://www.cve.org/cverecord?id=CVE-2025-34411]
CVE-2025-34412: https://www.cve.org/cverecord?id=CVE-2025-34412
[https://www.cve.org/cverecord?id=CVE-2025-34412]

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group) Yuffie Kisaragi via Fulldisclosure (Jan 05)