PT-2025-17533 · Crocoblock · Jetelements For Elementor

Name of the Vulnerable Software and Affected Versions: JetElements For Elementor versions 2.7.4.1 and earlier Description: The issue is related to missing authorization, allowing access to functionality not properly constrained by Access Control Lists ACLs. This could potentially lead to...

Amazon Linux AMI : libxslt (ALAS-2025-1968)

The version of libxslt installed on the remote host is prior to 1.1.28-6.16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2025-1968 advisory. xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes...

Fedora 41 : perl / perl-Devel-Cover / perl-PAR-Packer (2025-11fcc87c66)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-11fcc87c66 advisory. Fix CVE-2024-56406 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

📄 WordPress Easy Restaurant Manager 1.0 XSS / SQL Injection / IDOR

WordPress Easy Restaurant Manager plugin version 1.0 suffers from persistent cross site scripting, insecure direct object reference, a missing access control, and remote SQL injection vulnerabilities. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ .:. Exploit Title WordPress...

Citrix Virtual Apps and Desktops: Issues with Monitor Service after upgrade to 2402 CU2

Environment has been upgraded to 2402 CU2 version. When admin invokes a cmdlet: Get-MonitorConfiguration, the error is displayed: A database operation failed and could not be recovered : Reason ? Not all Delivery Controllers are affected and cmdlet returns actual configuration on some of the...

Slackware: Security Advisory (SSA:2025-108-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AlmaLinux 8 : kernel (ALSA-2025:3893)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:3893 advisory. kernel: xen: Xen hypercall page unsafe against speculative attacks Xen Security Advisory 466 CVE-2024-53241 kernel: ALSA: usb-audio: Fix out of bounds rea...

Dust: UI flaw allows unauthorized users to add documents to restricted folders

The UI flaw allowed unauthorized users to add documents to restricted folders. The vulnerability constituted an Insecure Direct Object Reference IDOR issue, where users could manipulate the client-side behavior to perform actions they were not supposed to have access to, such as uploading documen...

CVE-2025-3828

creationtimestamp| type| source ---|---|--- 2025-04-20 15:54:06+00:00| seen| https://bsky.app/profile/potato.software/post/3lnaz3ettzn2b 2025-04-20 16:01:34+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12615 2025-04-20 18:00:36+00:00| published-proof-of-concept|...

SecureMail WorxMail for iOS unable to sync with Exchange

We are currently experiencing an issue affecting access to Secure Mail on iOS devices. Users are getting an error from SecureMail "Access to your company network is not currently available" SecureMail logs ======================== " 2025-04-20T01:15:42.139+0300 ",SecureMail,ERROR...

Fedora 40 : webkitgtk (2025-256a86d7c8)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-256a86d7c8 advisory. Limit the data stored in session state. Remove the empty area below the title bar in Web Inspector when not docked. Fix various crashes and renderin...

Azure Linux 3.0 Security Update: edk2 / hvloader / openssl (CVE-2024-4741)

The version of edk2 / hvloader / openssl installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-4741 advisory. - Issue summary: Calling the OpenSSL API function SSLfreebuffers May cause memory to be...

youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

Description This advisory follows the security advisory GHSA-79w7-vh3h-8g4j published by the yt-dlp/yt-dlp project to aid remediation of the issue in the ytdl-org/youtube-dl project. Vulnerability youtube-dl does not limit the extensions of downloaded files, which could lead to arbitrary filename...

GHSA-GMG8-593G-7MV3 vulnerabilities

Vulnerabilities for packages: opensearch...

GHSA-3FVX-R9R8-XQ97 vulnerabilities

Vulnerabilities for packages: openjdk-11-openj9, openjdk-25-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk, openjdk-21-openj9, openjdk-crac, corretto, openjdk-17-openj9, cof-corretto...

CVE-2025-32442

Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different validation strategies for different content types have a possibility to bypass validation by providing a slightly altered content type such as...

You Can’t Secure What You Can’t See: The Real Pain CAASM Solves

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all! Let’s cut through the marketing haze for a moment. There’s a reas...

BELL-CVE-2025-22056

Bulletin has no description...

Oracle Database Server (April 2025 CPU)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2025 CPU advisory. - Security-in-Depth issue in the Oracle Database Grid Apache Tomcat component of Oracle Database Server. This vulnerability cannot be exploite...

CBL Mariner 2.0 Security Update: qemu (CVE-2023-3180)

The version of qemu installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-3180 advisory. - A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in...