CISA Directs Federal Agencies to Identify and Mitigate Potential Compromise of Cisco Devices

Today, CISA issued Emergency Directive ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices to address vulnerabilities in Cisco Adaptive Security Appliances ASA and Cisco Firepower devices. CISA has added vulnerabilities CVE-2025-20333link is external and CVE-2025-20362link is...

CISA Releases Advisory on Lessons Learned from an Incident Response Engagement

Today, CISA released a cybersecurity advisory detailing lessons learned from an incident response engagement following the detection of potential malicious activity identified through security alerts generated by the agency’s endpoint detection and response tool. This advisory, CISA Shares Lesson...

CVE-2025-42930

SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the availability of the application, there...

Linux Distros Unpatched Vulnerability : CVE-2019-17223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php. CVE-2019-17223 Note that Nessus relies on the presence of the package as...

CVE-2025-42930

SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the availability of the application, there...

CVE-2025-42930 Denial of Service (DoS) vulnerability in SAP Business Planning and Consolidation

SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the availability of the application, there...

CVE-2025-42930 Denial of Service (DoS) vulnerability in SAP Business Planning and Consolidation

SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the availability of the application, there...

SAP Business Planning and Consolidation 安全漏洞

SAP Business Planning and Consolidation is a business planning and consolidation software from SAP, Germany. The software provides budgeting, forecasting, and financial consolidation functions. A security vulnerability exists in SAP Business Planning and Consolidation, which stems from allowing...

CVE-2025-58439

ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left certain endpoints vulnerable to error-based SQL Injection. Some information like version could be retrieved. This issue is fixed in versions...

CVE-2025-58439

ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left certain endpoints vulnerable to error-based SQL Injection. Some information like version could be retrieved. This issue is fixed in versions...

CVE-2025-58439 ERP: Possibility of SQL injection due to missing validation

ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left certain endpoints vulnerable to error-based SQL Injection. Some information like version could be retrieved. This issue is fixed in versions...

CVE-2025-58439

CVE-2025-58439 concerns ERP (ERPNext) — an open source ERP. Publicly available details indicate a lack of parameter validation in versions below 14.89.2 and 15.0.0 through 15.75.1, enabling error-based SQL Injection on certain endpoints and potentially leaking version information. The issue is mi...

CVE-2025-58439 ERP: Possibility of SQL injection due to missing validation

ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left certain endpoints vulnerable to error-based SQL Injection. Some information like version could be retrieved. This issue is fixed in versions...

PT-2025-36343

Name of the Vulnerable Software and Affected Versions: ERP versions prior to 14.89.2 ERP versions 15.0.0 through 15.75.1 Description: ERP, a free and open source Enterprise Resource Planning tool, is susceptible to error-based SQL Injection due to insufficient validation of parameters. This allow...

PT-2025-35591

Name of the Vulnerable Software and Affected Versions: Doubo ERP version 1.0 Description: Doubo ERP version 1.0 contains an SQL injection flaw resulting from insufficient user input validation. This issue is remotely exploitable by an attacker. Recommendations: At the moment, there is no...

Doubo ERP 安全漏洞

Doubo ERP is a business management software from Doubo Inc. A security vulnerability exists in Doubo ERP version 1.0, which stems from insufficient filtering of user input and could lead to a SQL injection attack...

Linux Distros Unpatched Vulnerability : CVE-2021-42218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OMPL v1.5.2 contains a memory leak in VFRRT.cpp CVE-2021-42218 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL...

Apache OFBiz Code Execution Vulnerability (CNVD-2025-20870)

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A code execution vulnerability exists in Apache OFBiz versions prior to 24.09.02 that stems from improper...

CVE-2025-9391

A weakness has been identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this issue is the function getFieldValue of the component com.artery.workflow.ServiceImpl. This manipulation of the argument sql causes sql injection. The attack may be initiated remotely. The exploit has been made...

CVE-2025-9391 Bjskzy Zhiyou ERP com.artery.workflow.ServiceImpl getFieldValue sql injection

A weakness has been identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this issue is the function getFieldValue of the component com.artery.workflow.ServiceImpl. This manipulation of the argument sql causes sql injection. The attack may be initiated remotely. The exploit has been made...