Security Advisory April 2025 for Ivanti EPM 2024 and EPM 2022 SU6

Security Advisory Ivanti EPM 2022 SU6 and EPM 2024 Multiple CVEs Summary Ivanti has released updates for Ivanti Endpoint Manager which addresses medium and high vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability...

WordPress Hive Support plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hunter85 in WordPress Plugin Hive Support versions = 1.2.10...

CVE-2025-22013

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state There are several problems with the way hyp code lazily saves the host's FPSIMD/SVE state, including: Host SVE being discarded unexpectedly due to inconsistent...

CVE-2025-30671

creationtimestamp| type| source ---|---|--- 2025-04-08 11:28:44+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3lmcenvxscq22 2025-04-08 16:46:33+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10945 2025-04-08 19:51:25+00:00| seen| https://t.me/cvedetector/22477 2025-04-11...

CVE-2025-22017

In the Linux kernel, the following vulnerability has been resolved: devlink: fix xaalloccyclic error handling In case of returning 1 from xaalloccyclic wrapping ERRPTR1 will be returned, which will cause ISERR to be false. Which can lead to dereference not allocated pointer rel. Fix it by checkin...

CVE-2025-2882

creationtimestamp| type| source ---|---|--- 2025-04-08 07:46:12+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10855 2025-04-08 09:18:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmc5e6v36q2g 2025-04-08 11:29:14+00:00| seen| https://t.me/cvedetector/22427...

Cross-Site Scripting (XSS)

Vega, vega-functions is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient sandboxing, which allows unsupported JavaScript functions to be called from the Vega expression language...

CVE-2024-36246

creationtimestamp| type| source ---|---|--- 2025-04-08 04:46:30+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10842 2025-04-08 05:40:20+00:00| seen| https://bsky.app/profile/cyberalerts.bsky.social/post/3lmbr6vzdhz2c...

CVE-2025-3407

CVE-2025-3407 affects the Nothings stb up to f056911. The vulnerability is in the function stbhw_build_tileset_from_image, where manipulation of h_count/v_count leads to an out-of-bounds read. Reports state the attack can be launched remotely. There are no publicly available version details for a...

Adobe Commerce Access Control Vulnerability

Adobe Commerce is a leading global digital commerce solution for merchants and brands. Adobe Commerce suffers from an Access Control Error vulnerability that stems from improper access control, and no detailed vulnerability details are available at this time...

Adobe Framemaker buffer error vulnerability

Adobe Framemaker is the United States of America Odooby Adobe company's set of page layout software for writing and editing large or complex documents including structured documents. A buffer overflow vulnerability exists in Adobe Framemaker that originates from an out-of-bounds read, and no...

Adobe Commerce authorization issue vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce has an authorization issue vulnerability that stems from improper authorization, and no detailed vulnerability details are available at...

📄 Bus Pass Management System 1.0 SQL Injection

Bus Pass Management System version 1.0 suffers from a remote SQL injection vulnerability. Exploit Title: Bus Pass Management System v1.0 - Unauthenticated Union Based SQLi Manuel Exploit Date: 2025-04-07 Exploit Author: Mehmet Can Kadıoğlu a.k.a mao7un Vendor:...

Adobe Commerce Access Control Vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce suffers from an Access Control Error vulnerability that stems from improper access control, no details of the vulnerability are available...

CVE-2025-3388

creationtimestamp| type| source ---|---|--- 2025-04-07 23:47:45+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/10804 2025-04-08 03:06:57+00:00| seen| https://t.me/cvedetector/22369 2025-04-08 03:17:44+00:00| seen|...

WordPress Team Circle Image Slider With Lightbox plugin <= 1.0.4 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by Ala Arfaoui in WordPress Plugin Team Circle Image Slider With Lightbox versions = 1.0.4...

CVE-2025-28410

creationtimestamp| type| source ---|---|--- 2025-04-07 17:12:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmahf4z2wi2z 2025-04-07 18:44:44+00:00| seen| https://t.me/cvedetector/22320 2025-08-09 17:25:38+00:00| seen| MISP/a1f4de80-fff0-4971-8020-da8f70ab57ea 2025-09-10...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.0 release and security update

Red Hat JBoss Web Server 6.1.0 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2025-21423

creationtimestamp| type| source ---|---|--- 2025-04-07 15:07:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmaafholxb2g 2025-04-07 15:45:21+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10719 2026-01-24 22:43:17+00:00| seen|...