RLSA-2025:10195 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links CVE-2025-5986 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

CVE-2025-10306

CVE-2025-10306 – Backup Bolt (WordPress) is a vulnerability in the Backup Bolt plugin affecting all versions up to and including 1.4.1. The flaw, located in process_backup_batch(), allows authenticated attackers with Administrator-level access to download directories outside the webroot and write...

EUVD-2025-32271

The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the processbackupbatch function. This makes it possible for authenticated attackers, with Administrator-level access and above, to download...

CVE-2025-10306 Backup Bolt <= 1.4.1 - Authenticated (Admin+) Arbitrary File Download

The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the processbackupbatch function. This makes it possible for authenticated attackers, with Administrator-level access and above, to download...

CVE-2025-10306 Backup Bolt <= 1.4.1 - Authenticated (Admin+) Arbitrary File Download

The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the processbackupbatch function. This makes it possible for authenticated attackers, with Administrator-level access and above, to download...

Zyxel < 5.38 Directory Traversal

According to its banner, the version of Zyxel running on the remote host is 5.38. It is, therefore, affected by a Directory Traversal that could allow an attacker to download or upload files via a crafted URL. Note that the scanner has not tested for these issues but has instead relied only on th...

CVE-2025-10306: External Control of File Name or Path

The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the processbackupbatch function. This makes it possible for authenticated attackers, with Administrator-level access and above, to download...

WordPress plugin Backup Bolt 安全漏洞

WordPress Backup Bolt plugin is a backup plugin for WordPress websites, mainly used to automate the backup of website data including files, databases, etc., and support the recovery function. WordPress Backup Bolt plugin has an arbitrary file download vulnerability, which stems from a flaw in the...

CVE-2025-11182

The CVE-2025-11182 entry concerns GTONE ChangeFlow, where an improper pathname restriction (path traversal) combined with missing integrity checks on downloaded code exists in versions up to 9.0.1.1. Affected component: ChangeFlow download path handling; root cause: insufficient restriction of de...

CVE-2025-11182 File Download in GTONE ChangeFlow

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allows Path Traversal.This issue affects ChangeFlow: All versions to v9.0.1.1...

[SECURITY] [DLA 4314-1] python-internetarchive security update

Debian LTS Advisory DLA-4314-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert September 30, 2025 https://wiki.debian.org/LTS Package : python-internetarchive Version : 1.9.9-1+deb11u1 CVE ID : CVE-2025-58438 Debian Bug : 1114635 A vulnerability has been discovered...

Exploit for CVE-2025-56708

CVE-2025-56708&CVE-2025-56709 【CVE-2025-56709】savepath Bu...

SUSE CVE-2025-59410

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is hard coded to use the HTTP protocol, rather than HTTPS. This means that an attacker could perform a Man-in-the-Middle attack, changing th...

SUSE CVE-2025-9081

Mattermost versions 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration...

GO-2025-3978 Mattermost boards plugin fails to restrict download access to files in github.com/mattermost/mattermost-plugin-boards

Mattermost boards plugin fails to restrict download access to files in github.com/mattermost/mattermost-plugin-boards...

GO-2025-3974 DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly

DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly...

WordPress Houzez Theme - Functionality Plugin <= 4.1.2 - Arbitrary File Download Vulnerability

WordPress Houzez Theme - Functionality Plugin = 4.1.2 - Arbitrary File Download Vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Houzez Theme - Functionality versions = 4.1.2...

The vulnerability of the config.xgi function in D-Link DSL7740C router microprogramming software allows a hacker to load any desired file.

The vulnerability of the config.xgi function in D-Link DSL7740C router microprogramming software is related to access control deficiencies. Exploiting this vulnerability could allow a remote attacker to download any arbitrary file...

CVE-2025-9081

Mattermost versions 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration...