PT-2025-4264 · Oracle · Oracle Communications Order/Service Management

Name of the Vulnerable Software and Affected Versions: Oracle Communications Order and Service Management versions 7.4.0 through 7.5.0 Description: The issue allows a low-privileged attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful...

PT-2025-4266 · Oracle · Oracle Communications Order/Service Management

Name of the Vulnerable Software and Affected Versions: Oracle Communications Order and Service Management versions 7.4.0 through 7.5.0 Description: The issue is related to improper permission storage in the Oracle Communications Order and Service Management product, allowing a low-privileged...

Linphone Desktop 代码问题漏洞

Linphone Desktop is an open source software phone from Belledonne Communications for voice and video over IP calls and instant messaging. A code issue vulnerability exists in Linphone Desktop version 5.2.6, which stems from a null pointer reference vulnerability that could allow a remote attacker...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfcworkerwakeup bsc1225820. CVE-2024-27397: netfilter: nftables: use timestamp to check for set eleme...

CISA Releases Four Industrial Control Systems Advisories

CISA released four Industrial Control Systems ICS advisories on January 14, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-014-01 Hitachi Energy FOXMAN-UN ICSA-25-014-02 Schneider Electric Vijeo Designer...

PT-2025-3885 · Belledonne Communications · Linphone-Desktop

Name of the Vulnerable Software and Affected Versions: Belledonne Communications Linphone-Desktop affected versions not specified Description: The issue is a NULL Dereference vulnerability that could allow a remote attacker to create a denial-of-service condition. This vulnerability affects...

CVE-2024-54848

CVE-2024-54848 affects CP Plus CP-VNR-3104 (model B3223P22C02424). The CP-VNR-3104 firmware is reported to mishandle and store certificates, enabling attackers to decrypt traffic or perform man-in-the-middle attacks. CVSSv3.1 base score is 7.4 (High) with Network attack vector, high attack comple...

PT-2025-3273 · Redcap · Redcap

Name of the Vulnerable Software and Affected Versions: REDCap version 14.9.6 Description: A stored cross-site scripting XSS vulnerability in the built-in messenger of REDCap allows authenticated users to inject malicious scripts into the message field. When a user clicks on the received message,...

MAL-2025-23 Malicious code in zetessf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54b4e49ae22e5325a2ed8fe3e7a32f36e50fdf5fda9ea594cf72b24bd9c97788 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-19 Malicious code in nativescript-gainsight-px2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 12143d1c19f403559d49925266742f6b2ca75a3fda8ed195a4e0189bf64dce70 The OpenSSF Package Analysis project identified 'nativescript-gainsight-px2' @ 1.11.3 npm as malicious. It is considered malicious because: - Th...

AZL-55561 CVE-2024-56640 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix LGR and link use-after-free issue We encountered a LGR/link use-after-free issue, which manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making resource access unsafe. refcountt:...

MAL-2024-12133 Malicious code in aem-react-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54bb39f84add565409123e2afb033f2b001ab42f9fde0cdb31e4927d222e1419 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability in the web interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition systems allows attackers to perform cross-site scripting attacks and gain unauthorized access to protected information.

The vulnerability of the Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME web interfaces is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows an attacker to perform cross-site scripting...

CISA Releases Best Practice Guidance for Mobile Communications

Today, CISA released Mobile Communications Best Practice Guidance. The guidance was crafted in response to identified cyber espionage activity by People’s Republic of China PRC government-affiliated threat actors targeting commercial telecommunications infrastructure, specifically addressing...

CISCO-SA-20180110-UCM

creationtimestamp| type| source ---|---|--- 2024-12-17 06:41:53+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113666794725782259...

CISCO-SA-20180207-UCM1

creationtimestamp| type| source ---|---|--- 2024-12-17 06:41:07+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113666792958182205...

PT-2024-33696 · Ibm · Ibm Security Guardium Key Lifecycle Manager

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Key Lifecycle Manager versions 4.1, 4.1.1, 4.2.0, and 4.2.1 Description: The issue allows a remote attacker to obtain sensitive information in cleartext in a communication channel that can be detected by unauthorized...

A day in the life of a privacy pro, with Ron de Jesus (Lock and Code S05E26)

This week on the Lock and Code podcast… Privacy is many things for many people. For the teenager suffering from a bad breakup, privacy is the ability to stop sharing her location and to block her ex on social media. For the political dissident advocating against an oppressive government, privacy ...

Malicious code in spacexstats (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a3d5802346cd5966361f229a602839453998b6251e428ec6638141f6fcdb3c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11875 Malicious code in asymmetric-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d6f4c9090980b70af6effbd1be18a9ca571dd90a4f1cca30d44f84083dcec613 The OpenSSF Package Analysis project identified 'asymmetric-key-generator' @ 9.9.9 npm as malicious. It is considered malicious because: - The...