CLSA-2025-1756323821 php: Fix of CVE-2025-1736

CVE-2025-1736: fix incorrect validation of CRLF in http headers...

Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: Upgraded to version 9.4.58.v20250814: - CVE-2025-5115: Fixed MadeYouReset DoS attack via HTTP/2 protocol including DNS over HTTPS bsc1244252 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like...

Security update for tomcat11

This update for tomcat11 fixes the following issues: Updated to Tomcat 11.0.10 - CVE-2025-48989: Fixed "MadeYouReset" DoS in HTTP/2 due to client triggered stream reset bsc1243895 Other fixes: Catalina + Fix: Fix bloom filter population for archive indexing when using a packed WAR containing one...

Linux Distros Unpatched Vulnerability : CVE-2019-20041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wpksesbadprotocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as...

Linux Distros Unpatched Vulnerability : CVE-2021-21333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In...

CVE-2025-55618

In Hyundai Navigation App STD5W.EUR.HMC.230516.afa908d, an attacker can inject HTML payloads in the profile name field in navigation app which then get rendered...

CVE-2025-55618

The Hyundai Navigation App (version STD5W.EUR.HMC.230516.afa908d ) is vulnerable to an HTML injection flaw due to improper neutralization of input during web page generation. An attacker can inject HTML payloads into the profile name field, which are subsequently rendered by the application. To m...

Spring Framework HTTP Response Splitting

The vulnerability of the Spring Framework is related to the failure to handle CRLF sequences in HTTP headers or “HTTP response splitting”. Exploiting this vulnerability allows an attacker to perform a RFD attack by utilizing the “Content-Disposition” header...

Linux Distros Unpatched Vulnerability : CVE-2024-55918

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the Graphics::ColorNames package before 3.2.0 for Perl. There is an ambiguity between modules and filenames that can lead to HTML...

CVE-2025-35115 Agiloft insecure download of system packages

Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could replace or modify the contents of the download URL. Users should upgrade to Agiloft Release 30...

jsPDF Denial of Service (DoS)

Impact User control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of...

CVE-2025-52217

SelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly handle user-supplied input, allowing injection of arbitrary HTML...

CVE-2025-52217

The SelectZero Data Observability Platform is vulnerable to HTML Injection in versions prior to 2025.5.2 . The root cause is the improper handling of user-supplied input within legacy UI fields , which allows an attacker to inject arbitrary HTML . Impacting the integrity of the web interface, thi...

SUSE SLES15: tomcat10 / tomcat10-admin-webapps / tomcat10-doc / etc (SUSE-SU-2025:02978-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02978-1 advisory. Updated to Tomcat 10.1.43i: - CVE-2025-52520: Fixed integer overflow can lead to DoS for some unlikely configuration...

CVE-2025-52217

SelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly handle user-supplied input, allowing injection of arbitrary HTML...

PT-2025-34774 · Selectzero · Selectzero Data Observability Platform

Name of the Vulnerable Software and Affected Versions: SelectZero SelectZero Data Observability Platform versions prior to 2025.5.2 Description: SelectZero Data Observability Platform contains an Open Redirect vulnerability. Legacy UI fields can be used to create arbitrary external links via HTML...

CVE-2025-52219

The SelectZero Data Observability Platform (versions prior to 2025.5.2 ) is vulnerable to an Open Redirect vulnerability. The root cause is HTML Injection in legacy UI fields, which can be exploited to create arbitrary external links. To remediate this vulnerability, users are recommended to upda...

CVE-2025-52217

SelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly handle user-supplied input, allowing injection of arbitrary HTML...

Linux Distros Unpatched Vulnerability : CVE-2022-2048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ubuntu Linux - In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not...

Cisco Secure Firewall Threat Defense Remote Access VPN Web Server DoS (cisco-sa-asaftd-vpnwebs-dos-hjBhmBsX)

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability. - A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could all...