PT-2025-16176 · Undefined · Undefined

Security audit of PHP https://t.co/Tl4FK62NVP 2 high, 6 medium, 9 low severity, and 10 informative issues. 4 CVEs, 3 of them public and fixed last year, 1 not yet fully public: CVE-2024-8928: Memory-related vulnerability in PHP's filter handling, leading to segmentation faults...

GHSA-PG9F-39PC-QF8G vulnerabilities

Vulnerabilities for packages: zed, wadm, nushell, lychee, pixi, oxipng, rust-analyzer, samply, cargo-c, cargo-audit, ruff, oranda, yara-x, deno, yazi, fd, starship, wasmcloud...

GHSA-PG9F-39PC-QF8G vulnerabilities

Vulnerabilities for packages: cargo-audit, pixi, wadm, lychee, yara-x, oranda, samply, yazi, deno, starship, nushell, cargo-c, fd, ztunnel-fips, rust-analyzer, zed, wasmcloud, ruff, ztunnel, oxipng...

SurrealDB server-takeover via SurrealQL injection on backup import

The SurrealDB command-line tool allows exporting databases through the export command. It was discovered that table or field names are not properly sanitized in exports, leading to a SurrealQL injection when the backup is reimported. For the injection to occur, an authenticated System User with...

PT-2025-16150 · Crates.Io · Surrealdb

SurrealDB allows authenticated users with OWNER or EDITOR permissions at the root, database or namespace levels to define their own database functions using the DEFINE FUNCTION statement A custom database function comprises a name together with a function body. In the function body, the user...

April 11, 2025—KB5058919 (OS Builds 22621.5192 and 22631.5192) Out-of-band

None None...

April 11, 2025—KB5058921 (OS Build 14393.7973) Out-of-band

None None...

April 11, 2025—KB5058920 (OS Build 20348.3561) Out-of-band

None None...

April 11, 2025—KB5058922 (OS Build 17763.7240) Out-of-band

None None...

SurrealDB has local file read of 2-column TSV files via analyzers

An authenticated system user at the root, namespace, or database levels can use the DEFINE ANALYZER statement to point to arbitrary file locations on the file system, and should the file be tab separated with two columns, the analyzer can be leveraged to exfiltrate the content. This issue was...

📄 Microsoft SQL Server 2022 Missing Log Entry

Microsoft SQL Server 2022 fails to properly log when a security audit is configured for SERVERPERMISSIONCHANGEGROUP. Title: SQL Server 2022 Security Audit Failure Vulnerability Product: Microsoft SQL Server Affected Versions: 2022 RTM-CU18 KB5050771 Tested Versions: 2022 RTM-CU18 KB5050771 Fix:...

CVE-2025-31119

generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath...

generator-jhipster-entity-audit vulnerable to Unsafe Reflection when having Javers selected as Entity Audit Framework

Summary CWE-470 Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' when having Javers selected as Entity Audit Framework Details In the following two occurences, user input directly leads to class loading without checking against e.g. a whitelist of allowed classes...

CVE-2025-31119

generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath...

CVE-2025-31119 CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework

generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath...

CVE-2025-31119 CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework

generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath...

CVE-2025-31119 CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework

generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath...

BIT-DOLIBARR-2020-11823

In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...

generator-jhipster-entity-audit 安全漏洞

generator-jhipster-entity-audit is a JHipster module in the JHipster open source for enabling entity auditing and audit log pages. A security vulnerability exists in generator-jhipster-entity-audit versions prior to 5.9.1 that stems from insecure reflection that could lead to remote code executio...

PT-2025-14791 · Jhipster · Generator-Jhipster-Entity-Audit

Name of the Vulnerable Software and Affected Versions: generator-jhipster-entity-audit versions prior to 5.9.1 Description: The issue allows for unsafe reflection when Javers is selected as the Entity Audit Framework. If an attacker can place malicious classes into the classpath and access the RE...