Security Bulletin: Multiple vulnerabilities in NodeJS affect IBM Business Automation Workflow Configuration Editor

Summary IBM Business Automation Workflow Configuration Editor packages a vulnerable version of the NodeJS runtime and a vulnerable module. Vulnerability Details CVEID:CVE-2025-23165 DESCRIPTION: In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uvfss.file: a...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server traditional shipped with IBM Buinses Automation Workflow (CVE-2025-48976)

Summary WebSphere Application Server traditional is shipped as a component of IBM Business Automation Workflow. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security...

Security Bulletin: Multiple security vulnerabilities in Java affect IBM Business Automation Workflow - July 2025 CPU

Summary WebSphere Application Server traditional is shipped as a component of IBM Business Automation Workflow and requires IBM Java 8. Information about security vulnerabilities in IBM Java 8 have been published. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fix...

CVE-2025-9539

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwpajaximportautomationfromurl function in all versions up to, and...

Rockwell Automation FactoryTalk Activation Manager Data Exposure Vulnerability

Rockwell Automation is a leading global provider of industrial automation and control solutions focused on helping companies achieve smart manufacturing and digital transformation. A data disclosure vulnerability exists in Rockwell Automation FactoryTalk Activation Manager, which can be exploited...

Rockwell Automation ThinManager Server-Side Request Forgery Vulnerability

Rockwell Automation ThinManager is a thin client management software from Rockwell Automation, Inc. It allows thin clients to be assigned to multiple remote desktop servers simultaneously. A server-side request forgery vulnerability exists in Rockwell Automation ThinManager, which stems from...

erjinzhi 10OA 代码注入漏洞

erjinzhi 10OA is an enterprise automation system from China Binary erjinzhi. A code injection vulnerability exists in erjinzhi 10OA version 1.0, which stems from an incorrect manipulation of the parameter Name in the file /trial/mvc/finder, and could lead to a cross-site scripting attack...

Delta Electronics DIALink 安全漏洞

Delta Electronics DIALink is an industrial automation communication gateway from Delta Electronics China. A directory traversal vulnerability exists in Delta Electronics DIALink, which can be exploited by an attacker to cause authentication bypass...

HPESBNW04823 rev.1 - HPE Telco Unified Correlation and Automation (UCA), Multiple Vulnerabilities

Potential Security Impact: Local: Code Execution, Input Validation; Remote: Code Execution, Input Validation SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Unified Correlation and Automation 4.4.x prior to 4.4.5 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --...

CVE-2025-56405

An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the target's MCP service through the SSE protocol...

CVE-2025-10092

A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add of the component XML Handler. The manipulation results in xml external entity reference. The attack can be executed remotely. The exploit h...

The Time-Saving Guide for Service Providers: Automating vCISO and Compliance Services

Introduction Managed service providers MSPs and managed security service providers MSSPs are under increasing pressure to deliver strong cybersecurity outcomes in a landscape marked by rising threats and evolving compliance requirements. At the same time, clients want better protection without...

oasys 安全漏洞

oasys is an OA office automation system by the individual developer misstt123. A security vulnerability exists in oasys v1.1, which stems from the vulnerability of ProcedureController to directory traversal attacks...

PT-2025-37050

Name of the Vulnerable Software and Affected Versions: litmusautomation litmus-mcp-server versions through 0.0.1 Description: An issue allows unauthorized attackers to control the target's MCP service through the SSE Server-Sent Events protocol. Recommendations: At the moment, there is no...

CVE-2025-56405

A security vulnerability exists in litmusautomation litmus-mcp-server version 0.0.1 and earlier. This issue allows unauthorized attackers to take control of the target's MCP service by exploiting the SSE (Server-Sent Events) protocol. No specific remediation or patched version is currently availa...

CVE-2025-9065 Rockwell Automation ThinManager® Server-Side Request Forgery Vulnerability

A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attackers can exploit this vulnerability by specifying external SMB paths, exposing the ThinServer® service account NTLM hash...

CVE-2025-7970

CVE-2025-7970 affects Rockwell Automation’s FactoryTalk Activation Manager. The connected sources describe a cryptography implementation error that could allow an attacker to decrypt traffic, leading to data exposure, session hijacking, or full network communication compromise. Public disclosures...

CVE-2025-9364

CVE-2025-9364 describes an open Redis database issue in Rockwell Automation’s FactoryTalk Analytics LogixAI, caused by an overly permissive Redis instance. The vulnerability could allow an attacker on the intranet to access and potentially alter sensitive data. The entry lists high impact (CVSS v...

CVE-2025-9166 Rockwell Automation ControlLogix® 5580 V35.013 Denial-Of-Service

A denial-of-service security issue exists in the affected product and version. The security issue stems from the controller repeatedly attempting to forward messages. The issue could result in a major nonrecoverable fault on the controller...

CVE-2025-9166

CVE-2025-9166 affects Rockwell Automation’s ControlLogix 5580 controllers (notably versions including V35.013). The issue is a denial-of-service caused by the controller repeatedly forwarding messages, which can lead to a major nonrecoverable fault on the controller. Technical details across conn...