Security Bulletin: Vulnerability in Puma used by Logstash affect IBM Operations Analytics - Log Analysis (CVE-2024-45614)

Summary There is a potential HTTP request smuggling in Puma that affect Logstash used by IBM Operations Analytics - Log Analysis. Vulnerability Details CVEID:CVE-2024-45614 DESCRIPTION: Puma is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP X-Forwarded-For header. By...

WordPress ShopLentor plugin <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter vulnerability

Unauthenticated Server-Side Request Forgery via URL Parameter vulnerability discovered by mikemyers in WordPress Plugin ShopLentor versions = 3.1.2...

PT-2025-22270

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the pds core's adminq. The adminq is protected by the adminq lock, but completions happen in a different context, allowi...

WordPress HTML Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin HTML Forms versions = 1.5.2...

OESA-2025-1435 cobbler security update

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors,...

PT-2025-38560

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue in the i40e driver where an invalid memory access could occur when the MAC list is empty. The list first entry function does not return NULL, potential...

PT-2025-16497

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An attacker can export other users' plant information. This issue allows unauthorized access to sensitive data belonging to other users. Recommendations At the moment, there is no information...

PT-2025-16496

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The issue is due to a lack of server-side input validation, allowing attackers to inject malicious JavaScript code into users' personal spaces of the web portal. Recommendations At the moment,...

PT-2025-16392

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An unauthenticated attacker can check the existence of usernames in the system by querying an API. Recommendations At the moment, there is no information about a newer version that contains a...

PT-2025-16490

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An attacker can change registered email addresses of other users and take over arbitrary accounts. Recommendations At the moment, there is no information about a newer version that contains a...

PT-2025-16414

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An unauthenticated attacker can infer the existence of usernames in the system by querying an API. Recommendations At the moment, there is no information about a newer version that contains a...

PT-2025-16530

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The issue allows unauthenticated attackers to rename "rooms" of arbitrary users. This can potentially lead to unauthorized modifications of user settings or data. Recommendations At the moment...

PT-2025-22236

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to out-of-bounds relocation access in the Linux kernel's riscv module. The current code allows relj to access one element past the end of the relocation section. Thi...

PT-2025-20358

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference issue has been identified in the Linux kernel. The scpi cpufreq get rate function does not check if cpufreq cpu get raw returns NULL when the target CPU is not...

WordPress Interactive Geo Maps plugin <= 1.6.24 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh in WordPress Plugin Interactive Geo Maps versions = 1.6.24...

CVE-2025-32371 Unexpected external content may be displayed in DNN ImageHandler

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user that trusts the domain might think that t...

CVE-2025-30166 Pimcore's Admin Classic Bundle allows HTML Injection

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

CVE-2025-31475

CVE-2025-31475 affects tarteaucitron.js (prior to 1.20.1). The addOrUpdate function did not properly validate inputs, allowing an attacker with access to source or CMS plugins to perform prototype pollution, potentially modifying core JavaScript behavior, causing data corruption, crashes, or unin...

CVE-2025-30370

CVE-2025-30370 affects the jupyterlab-git JupyterLab extension. When a user opens a repository whose directory name contains a shell command substitution (e.g., $()) and selects “Git &gt; Open Git Repository in Terminal,” the extension previously executed a shell command via a cd to the repositor...

Security Bulletin: IBM Maximo Application Suite - Predict Component vulnerable to jinja is an extensible templating engine.

Summary Security Bulletin: IBM Maximo Application Suite - Predict Component vulnerable to jinja is an extensible templating engine. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-27516 DESCRIPTION: Jinja is an extensible...