SAP Netweaver Visual Composer Multiple Vulnerabilities (May 2025)

SAP NetWeaver Visual Composer is affected by multiple vulnerabilities, including the following: - SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the symlink creation process. An attacker can create or modify files outside of the intended sandboxed directory by creating a symlink that points to an external directory or file. Note: This is...

CVE-2025-43010

SAP S/4HANA Cloud Private Edition or on Premise SCM Master Data Layer MDL allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due to lack of input validation an...

Division by zero

Overview Affected versions of this package are vulnerable to Division by zero via the startinputtga function in rdtarga.c. An attacker can cause a denial of service by sending an image with a zero width or height, resulting in a SIGFPE. Remediation A fix was pushed into the master branch but not...

Incorrect Pointer Scaling

Overview Affected versions of this package are vulnerable to Incorrect Pointer Scaling through the inftrees.c component. An attacker can cause undefined behavior by exploiting improper pointer arithmetic. This is only exploitable if the PCL version is older than 1.14.0 or the user specifically...

Information Exposure

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Information Exposure via the Loader component. An attacker can leak sensitive cross-origin data by crafting...

Important: Red Hat Security Advisory: valkey security update

An update for valkey is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

kernel: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()

In the Linux kernel, the following vulnerability has been resolved: ipv4: iptunnel: Fix suspicious RCU usage warning in iptunnelinitflow There are code paths from which the function is called without holding the RCU read lock, resulting in a suspicious RCU usage warning 1. Fix by using...

CVE-2025-43010 Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))

SAP S/4HANA Cloud Private Edition or on Premise SCM Master Data Layer MDL allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due to lack of input validation an...

CVE-2025-43010

CVE-2025-43010 affects SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer). An authenticated attacker with SAP standard authorization can remotely execute a function module and replace arbitrary ABAP programs due to lack of input validation and missing authorization checks. Re...

ALSA-2025:7509 Important: valkey security update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

SAP Supplier Relationship Management 跨站脚本漏洞

SAP Supplier Relationship Management Master Data Management Catalog is a system for managing supplier relationships that provides master data management functionality. A cross-site scripting vulnerability exists in SAP Supplier Relationship Management Master Data Management Catalog that allows an...

Master image not visible while creating or updating MCS catalog

While creating a new catalog or updating an existing catalog, new Master image created on the vSphere hosting is not visible...

Siemens MS/TP Point Pickup Module 输入验证错误漏洞

The Siemens MS/TP Point Pickup Module is a BACnet MS/TP protocol signal acquisition conversion module from Siemens, Germany. An input validation error vulnerability exists in the Siemens MS/TP Point Pickup Module that stems from improper handling of BACnet MSTP messages, which could result in a...

SQL Injection

Overview github.com/3xxx/engineercms/models is a data management platform. Affected versions of this package are vulnerable to SQL Injection through the /project/addprojtemplet interface. An attacker can manipulate database queries and access or modify data without proper authorization by injecti...

Denial of Service (DoS)

Overview org.jeecgframework.boot:jeecg-boot-parent is a low-code development platform. Affected versions of this package are vulnerable to Denial of Service DoS through the unzipFile function. An attacker can cause excessive resource consumption by manipulating the File argument. Details Denial o...

SUSE CVE-2022-49899

In the Linux kernel, the following vulnerability has been resolved: fscrypt: stop using keyrings subsystem for fscryptmasterkey The approach of fs/crypto/ internally managing the fscryptmasterkey structs as the payloads of "struct key" objects contained in a "struct key" keyring has outlived its...

Buffer Over-read

Overview Affected versions of this package are vulnerable to Buffer Over-read due to the GB18030 encoding validation process. An attacker can achieve temporary denial of service by providing malformed input that triggers a buffer over-read. Remediation Upgrade libpq to version 14.22, 15.17, 16.13...

BlobTierInadequateForContentLength during Machine Catalog Update

The following error is seen while updating a MCS Machine Catalog after resizing the size of the Master VM disk. Exception: StudioErrorId : ProvisioningTaskError ErrorCategory : NotSpecified TaskState : FailedToCreateImagePreparationVm TaskStateInformation : Terminated ErrorId :...

How to create a PVS master target device on Hyper-V for Windows 11

The objective here is to creating a PVS master target device VM on Hyper-V, which can be used for both installing Windows 11 and also booting via PVS. Windows 11 has installation requirements which need both Secure boot and TPM available. Hyper-V VM options which are relevant here: Secure boot...