Security Bulletin: IBM WebSphere Application Server Liberty , which is bundled with IBM Cloud Pak for Applications, is vulnerable to a denial of service due to GraphQL Java (CVE-2024-40094)

Summary There is a vulnerability in the GraphQL Java library used by IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, with the mpGraphQL-1.0 or mpGraphQL-2.0 feature enabled. Vulnerability Details Refer to the security bulletins listed in the...

GHSA-WWX5-GPGR-VXR7 ismp-grandpa crate accepted incorrect signatures

A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. Description The vulnerability manifests as a verifer that only accepts incorrect signatures of Grandpa precommits and was introduce...

CVE-2025-24800

The CVE-2025-24800 vulnerability affects the ismp-grandpa crate used by Hyperbridge. A flaw in Grandpa signature verification could cause a malicious prover to convince the verifier of the finality of arbitrary headers, potentially enabling fund theft or compromise of cross-chain applications. Th...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana within Instana Agent container image build 288 Vulnerability Details CVEID:CVE-2024-12798 DESCRIPTION: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0...

BIT-RUBY-MIN-2021-28966

In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir...

2025 State of SaaS Backup and Recovery Report

The modern workplace has undergone a seismic transformation over recent years, with hybrid work becoming the norm and businesses rapidly adopting cloud-based Software-as-a-Service SaaS applications to facilitate it. SaaS applications like Microsoft 365 and Google Workspace have now become the...

New Research: The State of Web Exposure 2025

Are your websites leaking sensitive data? New research reveals that 45% of third-party apps access user info without proper authorization, and 53% of risk exposures in Retail are due to the excessive use of tracking tools. Learn how to uncover and mitigate these hidden threats and risks—download...

Oracle Critical Patch Update, January 2025 Security Update Review

Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, includin...

CVE-2024-42182

creationtimestamp| type| source ---|---|--- 2025-01-23 01:15:53+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgepgyidzm27 2025-01-23 01:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lgerej64hs2w 2025-01-23 03:16:15+00:00| seen|...

IBM WebSphere Liberty Profile DoS

The vulnerability of the modular application server of IBM WebSphere Liberty Profile, a software for managing transaction applications of the IBM TXSeries for Multiplatforms, is related to unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause...

Microsoft Access Memory Use After Free Code Execution

The vulnerability of the Microsoft Access database management system, Microsoft Office applications, and 365 Enterprise Apps is related to the use of memory after it is released. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Microsoft Office Microsoft 365 Apps for Enterprise Deserialization

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions...

SAP GUI Graphical User Interface Unauthorized Access

The vulnerability of the SAP GUI graphical user interface for Java relates to the disclosure of system data by unauthorized parties in the controlled area. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

UBUNTU-CVE-2025-21502

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Orac...

CVE-2025-21568

...

CVE-2025-21564

...

CVE-2025-21558

...

CVE-2025-21549

CVE-2025-21549 relates to Oracle WebLogic Server (Fusion Middleware) core in version 14.1.1.0.0. The vulnerability permits an unauthenticated attacker with network access over HTTP/2 to cause the WebLogic Server to hang or crash (complete DOS). This aligns with the CVSS v3.1 base score of 7.5 (Av...

CVE-2025-21549

...

CVE-2025-21542

CVE-2025-21542 affects Oracle Communications Order and Service Management (OC OSM) in versions 7.4.0, 7.4.1 and 7.5.0. The issue is described as an access control weakness in the Security component that, with network access over HTTP and using low privileges, allows unauthorized update/insert/del...