CVE-2024-41986

A vulnerability has been identified in SmartClient modules Opcenter QL Home SC All versions = V13.2 = V13.2 = V13.2 V2506. The affected application support insecure TLS 1.0 and 1.1 protocol. An attacker could achieve a man-in-the-middle attack and compromise confidentiality and integrity of data...

Vulnerabilities fixed in Azure products

Microsoft has fixed vulnerabilities in Azure products. The vulnerabilities are related to improper access control mechanisms, allowing authorized attackers to perform local spoofing attacks, obtain elevated privileges, reveal sensitive information and compromise the integrity of systems. This can...

The vulnerability of the lan743x_ptp_io_event_clock_get() function in the Linux kernel component allows a attacker to influence the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the lan743xptpioeventclockget function in the Linux kernel’s networking component involves reading data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protect...

CVE-2024-41986

CVE-2024-41986 affects Siemens SmartClient modules used by Opcenter QL Home, SOA Audit, and SOA Cockpit. The vulnerability arises because the affected applications support insecure TLS 1.0 and 1.1, enabling possible man‑in‑the‑middle attacks that could compromise confidentiality and data integrit...

openjdk: Enhance TLS protocol support (Oracle CPU 2025-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0....

openjdk: Improve scripting supports (Oracle CPU 2025-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows...

CVE-2025-55156

PyLoad (the Python-based download manager) contains a SQL Injection in the add_links parameter of the /json/add_package API. The issue allows attackers to modify or delete data in the database, causing data errors or loss. A patch was released in version 0.5.0b3.dev91; upgrading to this version (...

CVE-2025-54788

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on...

The vulnerability of the implementation of the JSON Web Encryption (JWE) standard RFC 7516 in the Ruby programming language allows a perpetrator to disclose and modify the protected information.

The vulnerability of the JSON Web Encryption JWE RFC 7516 standard implementation in the Ruby programming language is related to improper verification of data integrity. Exploiting this vulnerability could allow an attacker to disclose and modify the protected information...

The vulnerability in the Apache HTTP Server’s web server lies in improper checking of the return value of a function, allowing attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Apache HTTP Server is related to improper checking of the return value of a function. Exploiting this vulnerability allows an attacker, operating remotely, to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the mbedtls_aesni_has_support() function in the Mbed TLS software allows a attacker to compromise the integrity and confidentiality of the protected information.

The vulnerability of the mbedtlsaesnihassupport function in Mbed TLS is related to compiler optimization. Exploiting this vulnerability could allow an attacker to compromise the integrity and confidentiality of the protected information...

The vulnerability of the IBM Aspera Faspex file-sharing application, related to incorrect session expiration times, allows attackers to compromise the integrity of the protected information.

The vulnerability of the IBM Aspera Faspex file-sharing application is related to an incorrect session expiration time. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information from a remote location...

The vulnerability of the IBM Aspera Faspex file-sharing application, related to the implementation of security functions at the client side, allows attackers to compromise the integrity of the protected information.

The vulnerability of the IBM Aspera Faspex file-sharing application is related to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information from a remote location...

The vulnerability of the Advanced Notification Service (ANS) management service in the HarmonyOS operating system allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Advanced Notification Service ANS management service in the HarmonyOS operating system is related to the use of memory after deallocation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protecte...

Linux Distros Unpatched Vulnerability : CVE-2021-46958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between transaction aborts and fsyncs leading to use-after-free There is a...

The vulnerability of the get_cur_lang_ver() function in Netgear’s JWNR2000v2 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the getcurlangver function in Netgear JWNR2000v2 router microprogramming software is related to the copying of buffers without checking the size of the input data when processing the host parameter. Exploiting this vulnerability can allow an attacker to compromise the...

The vulnerability of the InboundEmail module in the SuiteCRM customer relationship management system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the InboundEmail module in the SuiteCRM customer relationship management system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the...

Advisory ROSA-SA-2025-2940

Software: exfatprogs 1.2.9 OS: ROSA-CHROME unaffected versions = exfatprogs-1.2.9-1 affected versions exfatprogs-1.2.9-1 CVE-ID: CVE-2023-45897 BDU-ID: 2024-03156 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the readfiledentryset function of the exfatprogs user-space utility is related to readi...

CVE-2025-54632

CVE-2025-54632 affects Huawei HarmonyOS/HVB module. The connected documents indicate the vulnerability stems from insufficient data length verification in the HVB module, with potential impact on service integrity (I/H, A/H), as reflected in multiple CVSS vectors (base scores 4.6–6.8). Exploitati...

The vulnerability of the formSetWAN_Wizard51() function (/goform/formSetWAN_Wizard51) in the D-Link DIR-619L router microprogramming software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetWANWizard51 function /goform/formSetWANWizard51 in the D-Link DIR-619L router microprogramming software is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to compromise the...