Modification of Assumed-Immutable Data (MAID)

Overview justhtml is an A pure Python HTML5 parser that just works. Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data MAID through the sanitize, sanitizedom, and JustHTML..., sanitize=True paths in src/justhtml/sanitize.py. An attacker can bypass intended...

Apache ActiveMQ Broker Jolokia MBeans Remote Code Execution Vulnerability

Apache ActiveMQ Broker is an open source message broker and integration pattern server . A security vulnerability exists in Apache ActiveMQ Broker. The vulnerability stems from the Jolokia JMX-HTTP bridge default policy that allows exec operations on MBeans, which can be exploited by an attacker ...

CVE-2023-29196

Discourse is an open source platform for community discussion. This vulnerability is not exploitable on the default install of Discourse. A custom feature must be enabled for it to work at all, and the attacker’s payload must pass the CSP to be executed. However, if an attacker succeeds in...

IBM Transformation Extender Advanced Weak Password Vulnerability

IBM Transformation Extender Advanced A data transformation, validation and standardization tool software from International Business Machines Corporation. IBM Transformation Extender Advanced suffers from a weak password vulnerability that stems from not requiring users to use strong passwords by...

CVE-2025-52615 HCL Unica Platform is impacted by misconfigured security related HTTP headers

HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies controlled by these headers...

sudo: LPE via host option

A privilege escalation vulnerability was found in Sudo. In certain configurations, unauthorized users can gain elevated system privileges via the Sudo host option -h or --host. When using the default sudo security policy plugin sudoers, the host option is intended to be used in conjunction with t...

Ensure That the Security Level of the Global Encryption Policy Is Not Lower than DEFAULT

The global encryption/decryption policy of the system is used to specify the algorithms supported by the encryption and decryption components. You can change the preset security policy level by modifying the /etc/crypto-policies/config configuration file to change the algorithm set that can be us...

Security update for pam_pkcs11

This update for pampkcs11 fixes the following issues: CVE-2025-24031: Fixed segmentation fault on ctrl-c/ctrl-d when asked for PIN bsc1237058. CVE-2025-24032: Fixed authentication bypass with default value for certpolicy none bsc1237062. Patch Instructions: To install this SUSE update use the SUS...

CODESYS Runtime Toolkit 安全漏洞

CODESYS Runtime Toolkit is a comprehensive software development kit for programmable controllers from CODESYS, Germany. It is used to convert embedded platforms or industrial PCs into controllers and supports secondary development. A security vulnerability exists in CODESYS Runtime Toolkit versio...

CVE-2023-35907

IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts...

PT-2025-1432 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 5.0.0 through 5.0.10 Description: The issue makes it easier for attackers to compromise user accounts due to the lack of a requirement for strong passwords by default. Recommendations: For IBM Aspera Faspex versions...

Important: Red Hat Security Advisory: RHACS 3.74 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes new features and bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Important: Red Hat Security Advisory: RHACS 4.0 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes new features and bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

SUSE CVE-2016-7030

FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in which system services run on...

SUSE CVE-2017-2293

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. This release adds default configuration to not allow these actions. Customers who rely on this...

Authorization

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data,...

CVE-2022-23451

CVE-2022-23451 concerns openstack-barbican. The issue is an authorization flaw where default secret-metadata API policy allows any authenticated user to add/modify/delete metadata on any secret, compromising ownership and enabling denial of service by resource consumption. The impact is described...

HCL Leap 安全漏洞

HCL Leap is a low-code development platform from HCL India. HCL Leap has a security vulnerability that stems from the presence of an insecure default file type filtering policy that allows execution of insecure JavaScript in deployed applications...

CVE-2022-27246

An issue was discovered in MISP before 2.4.156. An SVG org logo which may contain JavaScript is not forbidden by default...

CVE-2022-22167

A traffic classification vulnerability in Juniper Networks Junos OS on the SRX Series Services Gateways may allow an attacker to bypass Juniper Deep Packet Inspection JDPI rules and access unauthorized networks or resources, when 'no-syn-check' is enabled on the device. While JDPI correctly...