Debian dsa-5879 : libsaml-dev - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5879 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5879-1 [email protected] https://www.debian.org/security/ Moritz...

Security Updates for Microsoft Visual Studio 2019 16.11 Products (March 2025)

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including: - An undisclosed Visual Studio Elevation of Privilege Vulnerability CVE-2025-24998 - An undisclosed Visual Studio Elevation of Privilege Vulnerability...

CVE-2025-22870

CVE-2025-22870 has concrete details across connected docs: it impacts multiple Go-related packages (notably golang) and related ecosystems via a proxy matching bug. The flaw arises when IPv6 zone IDs are misinterpreted as hostname components in NO_PROXY, causing requests to [::1%25.example.com] t...

CVE-2025-27914

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting XSS vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to inject and execute arbitrary JavaScript in a victim's session. Exploitation requires a valid auth token...

CVE-2025-28874

Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Email Assign Templates: from n/a through = 1.7...

CVE-2025-28936

CVE-2025-28936 affects the WordPress plugin Lunar (Lunar – Sell photos online). The issue is a stored XSS caused by improper input neutralization during web page generation, affecting Lunar versions up to 1.3.0. The connected resources confirm the vulnerability title/description and affected vers...

CVE-2025-28930 WordPress List Mixcloud plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rodolphe MOULIN List Mixcloud list-mixcloud allows Stored XSS.This issue affects List Mixcloud: from n/a through = 1.4...

CVE-2025-24056

CVE-2025-24056 is a heap-based buffer overflow in the Windows Telephony Server that allows a network-based attacker to execute arbitrary code on affected systems. The issue is described as remote code execution with network access (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and a base score of 8.8 (HIG...

CVE-2025-2175 libzvbi _vbi_strndup_iconv integer overflow

A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function vbistrndupiconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to...

Exploit for Missing Authorization in Directsoftware Order_Attachments_For_Woocommerce

🚀 WooCommerce Arbitrary File Upload Exploit CVE-2024-9756...

CVE-2025-27910

creationtimestamp| type| source ---|---|--- 2025-03-10 23:51:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lk2qmoome52l 2025-03-11 00:54:11+00:00| seen| https://t.me/cvedetector/20005 2025-03-11 04:41:13+00:00| seen| Telegram/oNyCPEP5YRfouaWfL7ENByzKaZGZMhFrRppgbw0JB5dwfx6S...

CVE-2024-56184

In static long devsend of tipcdevql, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Security Bulletin: Snappy is a compression/decompression library which affects watsonx.data

Summary Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays, which may impact watsonx.data. Vulnerability Details CVEID:CVE-2024-36124 DESCRIPTION: iq80 Snappy is a compression/decompression library. When...

Advisory ROSA-SA-2025-2769

Software: python-jinja2 2.10.1 OS: ROSA Virtualization 3.0 packageevrstring: python-jinja2-2.10.1-5.rv30 CVE-ID: CVE-2024-22195 BDU-ID: 2024-00884 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the xmlattr filter of the Jinja2 templating engine for the Python programming language is related to a...

Advisory ROSA-SA-2025-2766

Software: rsync 3.1.3 OS: ROSA Virtualization 3.0 packageevrstring: rsync-3.1.3-20.rv30 CVE-ID: CVE-2024-12085 BDU-ID: 2025-00376 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the rsyncd daemon of the Rsync file transfer and synchronization utility is related to an operation exceeding buffer...

Advisory ROSA-SA-2025-2762

Software: python-jinja2 2.7.2 OS: rosa-server79 packageevrstring: python-jinja2-2.7.2-4.0.1.res7 CVE-ID: CVE-2024-56326 BDU-ID: 2025-00113 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the str.format method of the jinja html templating tool is related to the failure to neutralize special element...

Advisory ROSA-SA-2025-2761

Software: raptor2 2.0.9 OS: rosa-server79 packageevrstring: raptor2-2.0.9-3.0.1.res7 CVE-ID: CVE-2024-57823 BDU-ID: None CVE-Crit: CRITICAL. CVE-DESC.: An integer overflow vulnerability was discovered in the Raptor RDF Syntax Library when normalizing URIs using the turtle parser in the...

CVE-2024-13908

creationtimestamp| type| source ---|---|--- 2025-03-08 07:36:20+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/6929 2025-03-08 09:20:05+00:00| seen| https://t.me/cvedetector/19881 2025-03-08 10:30:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ljucwvij6j2f 2025-03-08...

CVE-2025-2097

creationtimestamp| type| source ---|---|--- 2025-03-07 22:35:37+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/6891 2025-03-08 00:00:48+00:00| published-proof-of-concept| Telegram/eDpAQjaVwA17w3Y5sBYHVYQe-wtpCg0af3TYkfxAg1BL6c 2025-03-08 01:48:37+00:00| seen|...

CVE-2025-20208

A vulnerability in the web-based management interface of Cisco TelePresence Management Suite TMS could allow a low-privileged, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based...