CVE-2011-0462

Multiple cross-site scripting XSS vulnerabilities in the login page in the webui component in SUSE openSUSE Build Service OBS before 2.1.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

SUSE-SU-2025:20336-1 Security update for ca-certificates-mozilla

This update for ca-certificates-mozilla fixes the following issues: - test for a concretely missing certificate rather than just the directory, as the latter is now also provided by openssl-3 - Re-create java-cacerts with SOURCEDATEEPOCH set for reproducible builds bsc1229003 - explicit remove...

📄 ABB Cylon FLXeon 9.3.5 variant.js Information Disclosure

The ABB Cylon FLXeon BACnet controller's /api/variant endpoint exposes sensitive system information, including the internal IP address, MAC address, device model, and build type, without requiring authentication. The get function gathers network interface data using the os.networkInterfaces API a...

Schneider Electric EcoStruxure Power Build Rapsody Buffer Overflow

The vulnerability of Schneider Electric EcoStruxure Power Build Rapsody software for electrical system design and configuration is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created malicious file...

CISA Releases Thirteen Industrial Control Systems Advisories

CISA released thirteen Industrial Control Systems ICS advisories on May 20, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-140-01 ABUP IoT Cloud Platform ICSA-25-140-02 National Instruments Circuit Design Sui...

Duping Cloud Functions: An emerging serverless attack vector

Summary and background Google Cloud Platform GCP Cloud Functions are event-triggered, serverless functions that automatically scale and execute code in response to specific events like Hypertext Transfer Protocol HTTP requests or data changes. Tenable Research published an article discussing a...

build-vocabulary (0.1.8) potentially affected by CVE-2025-47273 via setuptools (40.6.0)

setuptools PYPI version 40.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - build-vocabulary 0.1.8 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

scikit-build (0.2.0) potentially affected by CVE-2025-47273 via setuptools (25.0.0)

setuptools PYPI version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - scikit-build 0.2.0 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

abtests (>=0.0.1, <=0.0.2.1), scikit-build (0.4.0) potentially affected by CVE-2025-47273 via setuptools (28.3.0)

setuptools PYPI version 28.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - abtests =0.0.1, =0.0.2.1 - scikit-build 0.4.0 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

scikit-build (0.3.0) potentially affected by CVE-2025-47273 via setuptools (27.2.0)

setuptools PYPI version 27.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - scikit-build 0.3.0 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

scikit-build (0.3.0) potentially affected by CVE-2025-47273 via setuptools (27.2.0)

setuptools PYPI version 27.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - scikit-build 0.3.0 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...

scikit-build (0.2.0) potentially affected by CVE-2025-47273 via setuptools (25.0.0)

setuptools PYPI version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - scikit-build 0.2.0 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...

build-vocabulary (0.1.8) potentially affected by CVE-2025-47273 via setuptools (40.6.0)

setuptools PYPI version 40.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - build-vocabulary 0.1.8 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...

abtests (>=0.0.1, <=0.0.2.1), scikit-build (0.4.0) potentially affected by CVE-2025-47273 via setuptools (28.3.0)

setuptools PYPI version 28.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - abtests =0.0.1, =0.0.2.1 - scikit-build 0.4.0 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...

CVE-2025-47884

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a...

Security update for sqlite3

This update for sqlite3 fixes the following issues: Update to release 3.49.1: Improve portability of makefiles and configure scripts. CVE-2025-29087, bsc1241020: Fix a bug in the concatws function, introduced in version 3.44.0, that could lead to a memory error if the separator string is very lar...

External Control Of File Name Or Path

Microsoft.Build.Tasks.Core are vulnerable to External Control of File Name or Path. The vulnerability is due to external control of file name or path due to improper validation of input that allows an authorized attacker to manipulate file paths over a network...

ROS-20250515-04

The vulnerability of the docker CLI plugin that extends Buildx build capabilities is related to the fact that the software stores sensitive information in log files. software stores sensitive information in log files. Exploiting the vulnerability could allow an attacker to gain access to sensitiv...

ManageEngine ADAudit Plus < Build 8511 SQLi (CVE-2025-3834)

The version of ManageEngine ADAudit Plus installed on the remote host is prior to build 8511. It is, therefore, affected by a SQL injection vulnerability in the reports module.. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version...

ManageEngine ADSelfService Plus < build 6514 SQLi

According to its self-reported version, the ManageEngine ADSelfService Plus application running on the remote host is prior to build 6514. It is, therefore, affected by an authenticated SQL injection vulnerability in the MFA reports. Note that Nessus has not tested for this issue but has instead...