The Biosig Project libbiosig MFER Tag 3 null write stack-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2025-2236 The Biosig Project libbiosig MFER Tag 3 null write stack-based buffer overflow vulnerability August 25, 2025 CVE Number CVE-2025-46411 SUMMARY A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project...

RHEL 9 : aide (RHSA-2025:14493)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:14493 advisory. Advanced Intrusion Detection Environment AIDE is a utility that creates a database of files on the system, and then uses that database to ensure fil...

Oracle Linux 9 : firefox (ELSA-2025-14416)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14416 advisory. 128.14.0-2.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding R...

UTCMS 代码问题漏洞

UTCMS is a content management system built on the UT framework by the individual developer of usaltool. A code issue vulnerability exists in UTCMS version 9, which originates from a server-side request forgery of the UPDATEURL parameter in file app/modules/ut-frame/admin/update.php...

CentOS 9 : python3.9-3.9.23-2.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.23-2.el9 build changelog. - There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration APIs. The tar implementation would proce...

Oracle Linux 9 : aide (ELSA-2025-14493)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-14493 advisory. 0.16-103.2 RHEL 9.6.Z ERRATUM - CVE-2025-54389 aide: improper output neutralization enables bypassing Resolves: RHEL-109910 Tenable has extracted the preceding...

CVE-2025-9389

A vulnerability was identified in vim 9.1.0000. Affected is the function memmoveavxunalignederms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not...

Linux Distros Unpatched Vulnerability : CVE-2017-1000600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress version 4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to ...

Linux Distros Unpatched Vulnerability : CVE-2020-13672

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site Scripting XSS vulnerability in Drupal core's sanitization API fails to properly filter cross- site scripting under certain circumstances. This issue...

Linux Distros Unpatched Vulnerability : CVE-2014-3248

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera...

Malicious code in typescript-5.9 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 534854085104d22f0ac766feb226c4d29eaaa0b973c0d509362f32c415af7871 The OpenSSF Package Analysis project identified 'typescript-5.9' @...

MAL-2025-41341 Malicious code in typescript-5.9 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 534854085104d22f0ac766feb226c4d29eaaa0b973c0d509362f32c415af7871 The OpenSSF Package Analysis project identified 'typescript-5.9' @...

MAL-2025-41286 Malicious code in eslint-9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7b6f571e9facdadc164a1e0a5ed2a298a233bbc3138ef7df78bae9d0a3d588a4 The OpenSSF Package Analysis project identified 'eslint-9' @ 99.0.9 npm as malicious. It is considered malicious because: - The package...

CVE-2025-53971

Mattermost versions 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint...

CVE-2025-8023

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.9.x = 10.9.2 fails to sanitize path traversal sequences in template file destination paths, which allows a system admin to perform path traversal attacks via malicious path components, potentially enabling malicious file...

CVE-2025-55746

Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents without changes being applied to the files'...

WordPress Recurring PayPal Donations Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Recurring PayPal Donations versions = 1.8...

Fedora: Security Advisory (FEDORA-2025-9b8165a4b3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AlmaLinux 9 : tomcat (ALSA-2025:14181)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:14181 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125...

Mattermost has Potential Server Crash due to Unvalidated Import Data

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.10.x = 10.10.0, 10.9.x = 10.9.3 fail to validate import data which allows a system admin to crash the server via the bulk import feature...