Security Bulletin: IBM Cognos Controller is affected by vulnerabilities

Summary There are vulnerabilities in IBM® Java™, IBM® Websphere Application Server Liberty and Open-Source Software OSS components used by IBM Cognos Controller. Please refer to the table in the Related Information section for vulnerability impact. This Security Bulletin relates only to the direc...

Security Bulletin: IBM Controller is affected by vulnerabilities

Summary There are vulnerabilities in IBM® Websphere Application Server Liberty and Open-Source Software OSS components used by IBM Controller. Additionally, due to weak password requirements, IBM Controller is susceptible to compromised user accounts. Please refer to the table in the Related...

CVE-2025-28399

An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class...

CVE-2025-28399

An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class...

XMall 安全漏洞

XMall is a distributed e-commerce shopping mall based on SOA architecture by an individual developer at Exrick. A security vulnerability exists in XMall 1.1 and earlier versions, which stems from an elevation of privilege in the updateAddress method of the Address Controller class...

CVE-2025-28399

CVE-2025-28399 affects Erick xmall v1.1 and earlier. The vulnerability enables a remote attacker to escalate privileges via the updateAddress method in the Address Controller class. Public metrics indicate a CVSS v3.1 base score of 9.8 (CRITICAL; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected pro...

PT-2025-16382 · Unknown · Erick Xmall

Name of the Vulnerable Software and Affected Versions: Erick xmall versions 1.1 and earlier Description: An issue in Erick xmall allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class. Recommendations: For Erick xmall versions 1.1 and earlier,...

Vulnerability of the pcs_set_mux() function in the drivers/pinctrl/pinctrl-single.c module – The driver for supporting GPIO controllers in the Linux kernel allows a hacker to cause a service failure.

Vulnerability of the pcssetmux function in the drivers/pinctrl/pinctrl-single.c module – The Linux kernel’s PINCTRL output controller support driver relies on the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization CVE-2024-58092 In the Linux kernel, the following vulnerability has been resolved: keys: Fix UAF in keyput CVE-2025-21893 In the Linux kernel, the following...

Vulnerability of the ufshcd_exec_dev_cmd() function in the drivers/scsi/ufs/ufshcd.c module – This driver provides support for SCSI devices in the Linux operating system. It can be exploited by attackers to cause service failures.

Vulnerability of the ufshcdexecdevcmd function in the drivers/scsi/ufs/ufshcd.c module – The Linux kernel’s SCSI device support driver is vulnerable to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the nci_close_device() function in the net/nfc/nci/core.c module, which is part of the NFC NCI support for Linux operating systems, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the nciclosedevice function in the net/nfc/nci/core.c module, which supports NFC NCI implementations in Linux operating systems, is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: helm-push, cluster-api-helm-controller, flux, tw, k9s, chartmuseum, eksctl, cilium-cli, k8ssandra-client, kots, helm-docs, flux-source-controller, kubescape, trivy, zarf, rancher-helm, cert-manager-cmctl, flux-helm-controller, pluto, zot, chart-testing, helm-operator...

GHSA-4HFP-H4CW-HJ8P vulnerabilities

Vulnerabilities for packages: helm-push, cluster-api-helm-controller, flux, tw, k9s, chartmuseum, eksctl, cilium-cli, k8ssandra-client, kots, helm-docs, flux-source-controller, kubescape, trivy, zarf, rancher-helm, cert-manager-cmctl, flux-helm-controller, pluto, zot, chart-testing, helm-operator...

CVE-2025-32386 vulnerabilities

Vulnerabilities for packages: helm-push, cluster-api-helm-controller, flux, tw, k9s, chartmuseum, eksctl, cilium-cli, k8ssandra-client, kots, helm-docs, flux-source-controller, kubescape, trivy, zarf, rancher-helm, cert-manager-cmctl, flux-helm-controller, pluto, zot, chart-testing, helm-operator...

GHSA-5XQW-8HWV-WG92 vulnerabilities

Vulnerabilities for packages: helm-push, cluster-api-helm-controller, flux, tw, k9s, chartmuseum, eksctl, cilium-cli, k8ssandra-client, kots, helm-docs, flux-source-controller, kubescape, trivy, zarf, rancher-helm, cert-manager-cmctl, flux-helm-controller, pluto, zot, chart-testing, helm-operator...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: kots, cilium-cli, consul-k8s, consul-k8s-fips, kuma, kubescape, chartmuseum-fips, tw, zot, flux-source-controller-fips, flux-fips, helm-docs, k9s, harbor-fips, cluster-api-helm-controller-fips, pluto, rancher-helm, cert-manager-cmctl-fips, flux-source-controller,...

CVE-2025-32386 vulnerabilities

Vulnerabilities for packages: kots, cilium-cli, consul-k8s, consul-k8s-fips, kuma, kubescape, chartmuseum-fips, tw, zot, flux-source-controller-fips, flux-fips, helm-docs, k9s, harbor-fips, cluster-api-helm-controller-fips, pluto, rancher-helm, cert-manager-cmctl-fips, flux-source-controller,...

OESA-2025-1408 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flushworkqueue to prevent uaf Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the...

ABB Cylon FLXeon 9.3.4 - Default Credentials

ABB Cylon FLXeon 9.3.4 Default Credentials Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: FLXeon Series FBXi Series, FBTi Series, FBVi Series CBX Series FLX Series CBT Series CBV Series ABB UC32 Series Main Plant Controllers Cylon's UnitronUC32.xx Firmware: =9.3.4...

ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE)

Exploit title: ABB Cylon FLXeon 9.3.4 - Remote Code Execution RCE Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: FLXeon Series FBXi Series, FBTi Series, FBVi Series CBX Series FLX Series CBT Series CBV Series Firmware: =9.3.4 Summary: BACnet® Smart Building Controller...