CVE-2025-3852

The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email & password through the update function. This makes i...

WordPress plugin WPBookit 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

The vulnerability of the IBM Verify Identity Access system (formerly IBM Security Verify Access) relates to improper code generation, allowing a perpetrator to execute arbitrary code.

The vulnerability of the IBM Verify Identity Access system formerly IBM Security Verify Access is related to improper code generation. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code...

Security Bulletin: Disable IP forwarding

Summary Security Bulletin: Disable IP forwarding Vulnerability Details CVEID:CVE-1999-0511 DESCRIPTION: IP forwarding is enabled on a machine which is not a router or firewall. CVSS Source: NVD CVSS Base score: 7.5 CVSS Vector:AV:N/AC:L/Au:N/C:P/I:P/A:P Affected Products and Versions Affected...

CVE-2025-3610

The Reales WP STPT plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.1.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for authenticat...

Large Language Model-Driven Security Assistant for Internet of Things Via Chain-Of-Thought

The rapid development of Internet of Things IoT technology has transformed people's way of life and has a profound impact on both production and daily activities. However, with the rapid advancement of IoT technology, the security of IoT devices has become an unavoidable issue in both research an...

WordPress plugin WPBookit 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

fence-agents bug fix update

An update is available for fence-agents. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fence-agents packages provide a collection of scripts for handling...

client bug fix and enhancement update

An update is available for module.python-yubico, module.opendnssec, module.slapi-nis, module.softhsm, module.ipa, module.python-qrcode, custodia, module.custodia, module.pyusb, python-yubico, module.python-jwcrypto, module.python-kdcproxy, module.ipa-healthcheck, pyusb, slapi-nis, python-jwcrypto...

DL1 bug fix and enhancement update

An update is available for module.python-yubico, module.opendnssec, module.slapi-nis, module.softhsm, module.ipa, module.python-qrcode, custodia, module.custodia, module.pyusb, python-yubico, module.python-jwcrypto, module.python-kdcproxy, module.ipa-healthcheck, pyusb, slapi-nis, python-jwcrypto...

Malicious code in identityaccesspointsrv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7c91d904c61ea0d0dc69c3d616a5b6fc69014bc5694f175191f4f661a33341a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3688 Malicious code in identityaccesspointsrv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7c91d904c61ea0d0dc69c3d616a5b6fc69014bc5694f175191f4f661a33341a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Configure the Banner Path Correctly

The banner path points to a file which contains the prompt information displayed on the client before a user logs in to the SSH. The content in the file can be configured based on the actual service scenario. If the banner path is not set, no information is displayed by default...

Configure a Proper SSH Service Authentication Mode

A proper authentication mode helps ensure user and system data security. Typically, the user/password authentication mode is suitable for human-machine users. In non-interactive login scenarios, the public and private keys are suitable for authentication. In high-risk scenarios, only the public a...

Tenable Identity Exposure < 3.77.11 Multiple Vulnerabilities (TNS-2025-07)

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.11. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2025-07, including the following: - Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may...

Moodle Information Disclosure Vulnerability

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from an information disclosure vulnerability that stems from the fact that anonymous assignment submissions can...

CVE-2025-46572

passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a val...

CVE-2025-46573 passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling

passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done b...

CVE-2025-46572 passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping

passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a val...

CVE-2025-46815 ZITADEL Allows IdP Intent Token Reuse

The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id...