7920 matches found
PT-2025-39169
Name of the Vulnerable Software and Affected Versions OnePlus OxygenOS versions 12 through 15 Description A critical security issue exists in OnePlus devices running OxygenOS 12 through 15. This flaw allows any installed application to read SMS/MMS data and metadata from the system Telephony...
GHSA-GWRF-JF3H-W649 vulnerabilities
Vulnerabilities for packages: linkerd2-proxy-init, kserve-rest-proxy, terraform-provider-time, git-lfs, octo-sts, newrelic-nri-statsd, gostatsd, php-fpmexporter, cloud-provider-aws, newrelic-fluent-bit-output, vault-k8s, checksec, shfmt, vexctl, kubeflow-katib, mongodb-kubernetes-operator,...
CVE-2025-47906 vulnerabilities
Vulnerabilities for packages: linkerd2-proxy-init, kserve-rest-proxy, terraform-provider-time, git-lfs, octo-sts, newrelic-nri-statsd, gostatsd, php-fpmexporter, cloud-provider-aws, newrelic-fluent-bit-output, vault-k8s, checksec, shfmt, vexctl, kubeflow-katib, mongodb-kubernetes-operator,...
CVE-2025-47906 vulnerabilities
Vulnerabilities for packages: memcached-exporter-fips, dagdotdev, nats, karpenter-fips, cloud-provider-aws, prometheus-beat-exporter-fips, sftpgo-plugin-pubsub, yace-fips, local-path-provisioner, hivemind, custom-pod-autoscaler-operator, gitsign, kubernetes-csi-node-driver-registrar-fips,...
GHSA-GWRF-JF3H-W649 vulnerabilities
Vulnerabilities for packages: memcached-exporter-fips, dagdotdev, nats, karpenter-fips, cloud-provider-aws, prometheus-beat-exporter-fips, sftpgo-plugin-pubsub, yace-fips, local-path-provisioner, hivemind, custom-pod-autoscaler-operator, gitsign, kubernetes-csi-node-driver-registrar-fips,...
GHSA-69J8-PRX2-VX98 Mattermost Open Redirect vulnerability
Mattermost versions 10.10.x = 10.10.1, 10.5.x = 10.5.9, 10.9.x = 10.9.4 fail to validate the redirectto parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL...
CVE-2025-9072 One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter
Mattermost versions 10.10.x = 10.10.1, 10.5.x = 10.5.9, 10.9.x = 10.9.4 fail to validate the redirectto parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL...
Linux Distros Unpatched Vulnerability : CVE-2025-9943
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An SQL injection vulnerability has been identified in the ID attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is...
[SECURITY] [DLA 4300-1] shibboleth-sp security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4300-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès September 14, 2025 https://wiki.debian.org/LTS -...
DLA-4300-1 shibboleth-sp - security update
Bulletin has no description...
Debian dla-4300 : libapache2-mod-shib - security update
The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4300 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4300-1 [email protected] https://www.debian.org/lts/security/...
BIT-NIFI-2022-33140 Improper Neutralization of Command Elements in Shell User Group Provider
The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the...
BIT-NIFI-2020-13940
In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...
CVE-2025-9943
An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing f...
Malicious code in @flashbotts/ethers-provider-bundle (npm)
The package @flashbotts/ethers-provider-bundle was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88980ba81c782cffc6fd3ec8404e5c34d79fe5ae04b08f979135e503c9b01c4f Any computer that has this package installed or running should be...
MAL-2025-47028 Malicious code in @flashbotts/ethers-provider-bundle (npm)
The package @flashbotts/ethers-provider-bundle was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88980ba81c782cffc6fd3ec8404e5c34d79fe5ae04b08f979135e503c9b01c4f Any computer that has this package installed or running should be...
SUSE CVE-2025-9943
An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing f...
CLSA-2025-1757499160 Fix CVE(s): CVE-2025-5318
SECURITY UPDATE: out-of-bounds read in sftphandle function - debian/patches/CVE-2025-5318.patch: fix possible buffer overrun issue by changing comparison operator in sftphandle function - CVE-2025-5318...