net.praqma:monkit-plugin (>=0.2.5, <=1.0.0), org.jenkins-ci.main:jenkins-test-harness (1.426) +7 more potentially affected by CVE-2025-59476 via org.jenkins-ci.main:jenkins-core (1.426)

org.jenkins-ci.main:jenkins-core MAVEN version 1.426 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - net.praqma:monkit-plugin =0.2.5, =0.1, =1.0, =1.3 Source cves: CVE-2025-59476 Source advisory:...

GHSA-69J8-PRX2-VX98 Mattermost Open Redirect vulnerability

Mattermost versions 10.10.x = 10.10.1, 10.5.x = 10.5.9, 10.9.x = 10.9.4 fail to validate the redirectto parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL...

CVE-2025-9072 One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter

Mattermost versions 10.10.x = 10.10.1, 10.5.x = 10.5.9, 10.9.x = 10.9.4 fail to validate the redirectto parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL...

Linux Distros Unpatched Vulnerability : CVE-2025-9943

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An SQL injection vulnerability has been identified in the ID attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is...

[SECURITY] [DLA 4300-1] shibboleth-sp security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4300-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès September 14, 2025 https://wiki.debian.org/LTS -...

Debian dla-4300 : libapache2-mod-shib - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4300 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4300-1 [email protected] https://www.debian.org/lts/security/...

DLA-4300-1 shibboleth-sp - security update

Bulletin has no description...

BIT-NIFI-2022-33140 Improper Neutralization of Command Elements in Shell User Group Provider

The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the...

BIT-NIFI-2020-13940

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...

CVE-2025-9943

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing f...

Malicious code in @flashbotts/ethers-provider-bundle (npm)

The package @flashbotts/ethers-provider-bundle was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88980ba81c782cffc6fd3ec8404e5c34d79fe5ae04b08f979135e503c9b01c4f Any computer that has this package installed or running should be...

Malware in @flashbotts/ethers-provider-bundle

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-47028 Malicious code in @flashbotts/ethers-provider-bundle (npm)

The package @flashbotts/ethers-provider-bundle was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88980ba81c782cffc6fd3ec8404e5c34d79fe5ae04b08f979135e503c9b01c4f Any computer that has this package installed or running should be...

Malware in service-config-endpoint-provider

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

SUSE CVE-2025-9943

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing f...

CLSA-2025-1757499160 Fix CVE(s): CVE-2025-5318

SECURITY UPDATE: out-of-bounds read in sftphandle function - debian/patches/CVE-2025-5318.patch: fix possible buffer overrun issue by changing comparison operator in sftphandle function - CVE-2025-5318...

The Time-Saving Guide for Service Providers: Automating vCISO and Compliance Services

Introduction Managed service providers MSPs and managed security service providers MSSPs are under increasing pressure to deliver strong cybersecurity outcomes in a landscape marked by rising threats and evolving compliance requirements. At the same time, clients want better protection without...

CVE-2024-4741 vulnerabilities

Vulnerabilities for packages: libcrypto3-2.34, openssl, openssl-provider-fips...

GHSA-6VGQ-8QJQ-H578 vulnerabilities

Vulnerabilities for packages: libcrypto3-2.34, openssl, openssl-provider-fips...

DEBIAN-CVE-2025-9943

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing f...