CVE-2025-34238 Advantech WebAccess/VPN < 1.1.5 Path Traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web...

Security Bulletin: Security vulnerabilities in Apache kafka-client may affect IBM Business Automation Workflow - CVE-2025-27817, CVE-2025-27818

Summary IBM Business Automation Workflow packages a copy of Apache kafka-client with known vulnerabilities. Vulnerability Details CVEID:CVE-2025-27818 DESCRIPTION: A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource,...

CVE-2025-12675

The KiotViet Sync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveConfig function in all versions up to, and including, 1.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update...

PT-2025-45390

Name of the Vulnerable Software and Affected Versions affected versions not specified Description Insufficient sanitization allows an attacker to upload a specially crafted configuration file, leading to directory traversal and remote code execution with system-level permissions. Recommendations ...

Core Config Manager Privilege Escalation Command Injection

The vulnerability of the Core Config Manager CCM component of the Nagios XI IT infrastructure monitoring tool is related to the failure to take measures to neutralize specific elements. Exploiting this vulnerability can allow a malicious actor to enhance their privileges, execute arbitrary...

Advantech WebAccess/VPN security vulnerabilities

Advantech WebAccess/VPN is a virtual private network feature integrated in Advantech WebAccess/SCADA software, designed to provide a secure and reliable network connectivity solution for industrial automation and remote monitoring systems. An absolute path traversal vulnerability exists in...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990629)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990629 advisory. In the Linux kernel, the following vulnerability has been resolved: tty: Fix a possible resource leak in icomprobe When pcireadconfigdword failed, call...

CVE-2025-62520

Mantis Bug Tracker MantisBT is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to manageconfigcolumnspage.php can use the Copy From action to retrieve the columns configuration from a private project they have no...

GO-2025-4088 sqls-server/sqls is vulnerable to command injection in the config command in github.com/sqls-server/sqls

sqls-server/sqls is vulnerable to command injection in the config command in github.com/sqls-server/sqls...

CVE-2025-55108

The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled i.e. in the default configuration. NOTE: The vendor believes that this vulnerability only occurs when...

CVE-2025-12675

The KiotViet Sync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveConfig function in all versions up to, and including, 1.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update...

CVE-2025-61141

sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988800)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988800 advisory. In the Linux kernel, the following vulnerability has been resolved: tty: Fix a possible resource leak in icomprobe When pcireadconfigdword failed, call...

PT-2025-45886

sqls-server/sqls is vulnerable to command injection in the config command in github.com/sqls-server/sqls...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990319)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990319 advisory. In the Linux kernel, the following vulnerability has been resolved: powerpc/imc-pmu: Fix use of mutex in IRQs disabled section Current imc-pmu code triggers a WARNIN...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-989020)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989020 advisory. In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix possible crash in bnxthwrmsetcoal During the error recovery sequence, the rtnllock is...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-989948)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989948 advisory. In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid pcidevlock AB/BA deadlock with sriovnumvfsstore The sysfs sriovnumvfsstore path acquir...

RockyLinux 8 : sssd (RLSA-2025:19610)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:19610 advisory. sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems CVE-2025-11561 Tenable has extracted the preceding description...

CVE-2025-64318

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1...

CVE-2025-64319

Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1...