CVE-2025-36116: Missing Origin Validation in WebSockets

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that th...

CVE-2025-36117: Session Fixation

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system...

CVE-2025-7872

A vulnerability was found in Portabilis i-Diario 1.5.0 and classified as problematic. This issue affects some unknown processing of the file /justificativas-de-falta. The manipulation of the argument Justificativa leads to cross site scripting. The attack may be initiated remotely. The exploit ha...

CVE-2025-7871

A vulnerability has been found in Portabilis i-Diario 1.5.0 and classified as problematic. This vulnerability affects unknown code of the file /conteudos. The manipulation of the argument filterbydescription leads to cross site scripting. The attack can be initiated remotely. The exploit has been...

CVE-2025-7870

A vulnerability, which was classified as problematic, was found in Portabilis i-Diario 1.5.0. This affects an unknown part of the component justificativas-de-falta Endpoint. The manipulation of the argument Anexo leads to cross site scripting. It is possible to initiate the attack remotely. The...

CVE-2025-7868

A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educarcalendariodiamotivocad.php of the component Calendar Module. The manipulation of the argument Motivo/descricao results in cross site scripting. It is possible to...

CVE-2025-7867

A vulnerability has been found in Portabilis i-Educar 2.9.0/2.10.0. This vulnerability affects unknown code of the file /intranet/agenda.php of the component Agenda Module. The manipulation of the argument novotitulo/novodescricao leads to cross site scripting. It is possible to initiate the atta...

CVE-2025-7869

A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file intranet/educarturmatipodet.php?codturmatipo=ID of the component Turma Module. The manipulation of the argument nmtipo leads to cross...

CVE-2025-7866

A vulnerability was found in Portabilis i-Educar 2.9.0. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/educardeficiencialst.php of the component Disabilities Module. The manipulation of the argument Deficiência ou Transtorno leads to cross site...

VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 have operating system command injection vulnerabilities

TP-Link VIGI NVR1104H-4P V1 and TP-Link VIGI NVR2016H-16MP V2 are both network video recorders from China P&L TP-Link. Operating system command injection vulnerability exists in VIGI NVR1104H-4P V1 prior to version 1.1.5 Build 250518 and VIGI NVR2016H-16MP V2 prior to version 1.3.1 Build 250407,...

Security update for the Linux Kernel (Live Patch 4 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-1506002322 fixes several issues. The following security issues were fixed: CVE-2024-53146: NFSD: Prevent a potential integer overflow bsc1234854. CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability bsc1235005. CVE-2024-53173:...

SUSE-SU-2025:02419-1 Security update for the Linux Kernel (Live Patch 29 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-15040024128 fixes several issues. The following security issues were fixed: - CVE-2024-53146: NFSD: Prevent a potential integer overflow bsc1234854. - CVE-2022-49465: blk-throttle: Set BIOTHROTTLED when bio has been throttled bsc1238920. - CVE-2024-53214:...

ROS-20250721-01

The vulnerability of the iorwinitfile function of the iouring/rw.c module of the asynchronous I/O interface of the kernel of the of Linux operating system is related to reuse of previously freed memory. Exploitation exploitation of the vulnerability could allow an attacker to affect the...

CVE-2025-7872

A weakness has been identified in Portabilis i-Diario 1.5.0. This affects an unknown function of the file /justificativas-de-falta. Executing a manipulation of the argument Justificativa can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to...

CVE-2025-7872

Portabilis i-Diario 1.5.0 is affected by CVE-2025-7872. The vulnerability arises from improper handling of the Justificativa parameter in the file /justificativas-de-falta, allowing cross-site scripting. It can be exploited remotely, and public exploit information has been disclosed; vendor respo...

CVE-2025-7872 Portabilis i-Diario justificativas-de-falta cross site scripting

A weakness has been identified in Portabilis i-Diario 1.5.0. This affects an unknown function of the file /justificativas-de-falta. Executing a manipulation of the argument Justificativa can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to...

CVE-2025-7872 Portabilis i-Diario justificativas-de-falta cross site scripting

A weakness has been identified in Portabilis i-Diario 1.5.0. This affects an unknown function of the file /justificativas-de-falta. Executing a manipulation of the argument Justificativa can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to...

CVE-2025-7872 Portabilis i-Diario justificativas-de-falta cross site scripting

A weakness has been identified in Portabilis i-Diario 1.5.0. This affects an unknown function of the file /justificativas-de-falta. Executing a manipulation of the argument Justificativa can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to...

CVE-2025-7871

A security flaw has been discovered in Portabilis i-Diario 1.5.0. The impacted element is an unknown function of the file /conteudos. Performing a manipulation of the argument filterbydescription results in cross site scripting. The attack may be initiated remotely. The exploit has been released ...

CVE-2025-7870

A vulnerability was identified in Portabilis i-Diario 1.5.0. The affected element is an unknown function of the file app/uploaders/docuploader.rb of the component justificativas-de-falta Endpoint. Such manipulation of the argument Anexo leads to cross site scripting. The attack can be launched...