PT-2025-4627 · WordPress · Wp Travel

Name of the Vulnerable Software and Affected Versions: WP Travel versions prior to 10.1.0 Description: The issue is related to improper neutralization of special elements used in an SQL command, which allows SQL injection. This means that an attacker could potentially inject malicious SQL code to...

The vulnerability lies in the system for managing configuration files and remote execution of operations called Salt. The Python web framework Tornado allows attackers to gain unauthorized access to protected information.

The vulnerability of the configuration management system and the remote execution of operations, such as Salt, is related to the use of open redirection in the Python Tornado web framework. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected...

CVE-2024-56903

Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as account management. This vulnerability is used in chain with CVE-2024-56901 for a successful CSRF attack...

CVE-2024-56903

Geovision GV-ASWeb/GV-ASManager (version 6.1.1.0 or earlier) is affected by CVE-2024-56903, where attackers can abuse a CSRF chain with CVE-2024-56901 to modify POST to GET requests targeting critical functions (e.g., account management) and potentially create admin accounts. The EDB exploit note...

FUNNULL Unmasked: AWS, Azure Abused for Global Cybercrime Operations

Discover how cybercriminals use 'Infrastructure Laundering' to exploit AWS and Azure for scams, phishing, and money laundering. Learn about FUNNULL CDN's tactics and their global impact on businesses and cybersecurity...

Vulnerabilities fixed in VMware Aria Operations

VMware has fixed vulnerabilities in VMware Aria Operations. The vulnerabilities include an information leak that allows malicious users with View Only Admin privileges to potentially read the login credentials of integrated VMware products. In addition, there is a stored cross-site scripting...

Broadcom Patches VMware Aria Flaws – Exploits May Lead to Credential Theft

Broadcom has released security updates to patch five security flaws impacting VMware Aria Operations and Aria Operations for Logs, warning customers that attackers could exploit them to gain elevated access or obtain sensitive information. The list of identified flaws, which impact versions 8.x o...

CVE-2024-46974 GPU DDK - Arbitrary write of read-only dmabuf

Software installed and run as a non-privileged user may conduct improper read/write operations on imported/exported DMA buffers...

CVE-2024-46974

CVE-2024-46974 is tracked across multiple feeds with concrete details: a vulnerability in Imagination Technologies’ GPU driver (PowerVR-GPU) that enables a non-privileged local user to perform improper read/write operations on imported/exported DMA buffers. The NVD entry lists a high impact (CVSS...

CVE-2024-23929 Pioneer DMH-WT7600NEX Telematics Directory Traversal

This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

Ubuntu: Security Advisory (USN-7240-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Imagination GPU Driver 安全漏洞

Imagination GPU Driver is a graphics driver from Imagination. A security vulnerability exists in Imagination GPU Driver. An attacker exploiting this vulnerability could perform incorrect read and write operations...

IBM Security Verify Directory 代码问题漏洞

IBM Security Verify Directory is part of an authentication and access management solution from International Business Machines IBM. A code issue vulnerability exists in IBM Security Verify Directory that stems from vulnerability to denial of service attacks when sending LDAP extension operations...

Google: Over 57 Nation-State Threat Groups Using AI for Cyber Operations

Over 57 distinct threat actors with ties to China, Iran, North Korea, and Russia have been observed using artificial intelligence AI technology powered by Google to further enable their malicious cyber and information operations. "Threat actors are experimenting with Gemini to enable their...

CVE-2025-22221

VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria Operations for Logs may be able to inject a malicious script that could be executed in a victim's browser when performing a delete action in the Agent...

CVE-2025-22222

VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit this vulnerability to retrieve credentials for an outbound plugin if a valid service credential ID is known...

CVE-2025-22221

VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria Operations for Logs may be able to inject a malicious script that could be executed in a victim's browser when performing a delete action in the Agent...

CVE-2025-22220

VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria Operations for Logs API may be able to perform certain operations in the context of an admin user...

CVE-2025-22220

VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria Operations for Logs API may be able to perform certain operations in the context of an admin user...

CVE-2025-22220

VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria Operations for Logs API may be able to perform certain operations in the context of an admin user...