Oracle Linux 7 : compat-libtiff3 (ELSA-2025-17710)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-17710 advisory. 3.9.4-12.0.1 - Fixes CVE-2025-9900 buffer underflow Orabug: 38523840 Tenable has extracted the preceding description block directly from the Oracle Linux...

Important: Red Hat Security Advisory: squid security update

An update for squid is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

StarCharge Artemis AC Charger 安全漏洞

StarCharge Artemis AC Charger is an AC charger from StarCharge Singapore. A security vulnerability exists in the StarCharge Artemis AC Charger version 7-22 kW 1.0.4, which stems from the use of a hard-coded AES key, which could allow an attacker to forge or decrypt a valid login token...

CVE-2025-52264: Improper Restriction of Operations within the Bounds of a Memory Buffer

StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a stack overflow via the cgiMain function at download.cgi...

CVE-2025-52263: Download of Code Without Integrity Check

An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to upload crafted firmware, leading to arbitrary code execution...

CVE-2025-62915: Missing Authorization

Missing Authorization vulnerability in clicksend SMS Contact Form 7 Notifications by ClickSend clicksend-contactform7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Contact Form 7 Notifications by ClickSend: from n/a through = 1.4.0...

CVE-2025-52268: Exposure of Sensitive Information to an Unauthorized Actor

StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens...

CVE-2025-9562

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qsdate shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Redirection for Contact Form 7 plugin <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via qsdate Shortcode vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Redirection for Contact Form 7 versions = 3.2.6...

PT-2025-42703

Name of the Vulnerable Software and Affected Versions Redirection for Contact Form 7 plugin for WordPress versions up to and including 3.2.6 Description The software contains a flaw that allows for the injection of malicious web scripts into pages. This is due to inadequate handling of...

CVE-2025-9562: Improper Neutralization of Input During Web Page Generation

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qsdate shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Rockwell Automation PanelView Plus 7 Performance Series B Authentication Bypass Vulnerability

Rockwell Automation PanelView Plus 7 Performance Series B is a versatile HMI application from Rockwell Automation. An authentication bypass vulnerability exists in Rockwell Automation PanelView Plus 7 Performance Series B, which can be exploited by an attacker to cause unauthorized access,...

Oracle Linux 7 : httpd (ELSA-2025-14997)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14997 advisory. 2.4.6-99.0.7.1 - Fixed security update CVE-2024-47252 CVE-2025-49812 Orabug: 38378160 Tenable has extracted the preceding description block directly...

CVE-2025-9063

CVE-2025-9063 concerns an authentication bypass in the FactoryTalk View Machine Edition Web Browser ActiveX control, enabling an unauthenticated attacker on the same network to gain access to the PanelView Plus 7 Series B file system, diagnostic information, and event logs. Connected sources conf...

[SECURITY] [DLA 4330-1] ghostscript security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4330-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA October 14, 2025 https://wiki.debian.org/LTS -...

CVE-2025-9063: Improper Authentication

An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows unauthorized access to the PanelView Plus 7 Series B, including access to the file system, retrieval of diagnostic information, event logs,...

CVE-2025-9551

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5...

A Bootiful Podcast: Spring Security contributor Josh Cummings on the latest-and-greatest in Spring Security 7

Hi, Spring fans! In this installment we talk to Spring Security contributor and legend Josh Cummings...

Oracle Linux 7 : udisks2 (ELSA-2025-16130)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-16130 advisory. 2.8.4-1.0.1 - Fix index underflow in LoopSetup CVE-2025-8067 Orabug: 38444282 Tenable has extracted the preceding description block directly from the Oracle...

GHSA-378F-8Q54-3FQX Liferay Portal is vulnerable to Stored XSS through Forms text type field

Stored cross-site scripting XSS vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a...