Buffer Over-read

Overview Affected versions of this package are vulnerable to Buffer Over-read via improper output length handling in the GIF LZW decoding process. An attacker can access limited portions of uninitialized memory by providing a specially crafted GIF file that triggers the inclusion of arbitrary...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to Cross-site Scripting (XSS) due to express.js ( CVE-2024-43796 )

Summary Potential vulnerabilities in express.js package CVE-2024-43796 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-43796 DESCRIPTION: Express.js minimalist web framework for node. In express 4.20.0, passing untrusted user input - even after...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to to Cross-Site Request Forgery (CSRF) due to insecure debugger access in Werkzeug ( CVE-2024-34069)

Summary Potential vulnerabilities in Werkzeug has been identified that may affect IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-34069 DESCRIPTION: Werkzeug is a comprehensive WSGI web application library. The debugger in affected version...

Qualys TotalCloud Wins “Best Cloud Security Product” at 2025 SC Awards Europe

We’re proud to announce that Qualys TotalCloud has been named “Best Cloud Security Product” at the 2025 SC Awards Europe —a recognition of our relentless drive to unify, simplify, and modernize cloud security for enterprises across the globe. In today’s complex multi-cloud world, securing...

Qualys VMDR Wins at 2025 SC Awards Europe for Best Vulnerability Management Solution

We’re excited to share that Qualys VMDR Vulnerability Management, Detection, and Response has won the Best Vulnerability Management Solution for 3 years in row at 2025 SC Awards Europe , recognizing its market-leading innovation and measurable impact in reducing cyber risk for businesses worldwid...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to improper verification of cryptographic signature due to elliptic ( CVE-2024-48949 )

Summary Potential vulnerabilities in elliptic module CVE-2024-48949 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-48949 DESCRIPTION: The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits...

Security Bulletin: IBM Cloud Pak for Data s vulnerable to Improper Input Validation due to follow-redirects ( CVE-2023-26159 )

Summary Potential vulnerabilities in follow-redirects module has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2023-26159 DESCRIPTION: Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper...

Security Bulletin: LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code, affect watsonx.data

Summary LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request intended for server-side color lookup contains a flaw allowing a client to send color-name requests with a name longer than the maximum si...

CVE-2025-6090

CVE-2025-6090 affects H3C GR-5400AX V100R009L50. The vulnerability is a buffer overflow in the UpdateWanparamsMulti/UpdateIpv6params handlers within /routing/goform/aspForm caused by manipulating the param argument. Exploitation is possible remotely and the exploit has been disclosed publicly. Mu...

CVE-2025-6090 H3C GR-5400AX aspForm UpdateIpv6params buffer overflow

A vulnerability was found in H3C GR-5400AX V100R009L50 and classified as critical. This issue affects the function UpdateWanparamsMulti/UpdateIpv6params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack may be initiated remotely. The...

Parrot and DJI variants Drone OSes - Kernel Panic Exploit

!/usr/bin/env python3 Exploit Title: Parrot and DJI variants Drone OSes - Kernel Panic Exploit Author: Mohammed Idrees Banyamer Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer Date: 2025-06-10 Tested on: Parrot QRD, Parrot Alpha-M, DJI QRD, DJI Alpha-M CVE: CVE-2025-37928 Type:...

Security Bulletin: A Security Vulnerability was discovered in the IBM Security Directory Container (CVE-2025-1411)

Summary The IBM Security Directory Container has addressed a security vulnerability in an update Vulnerability Details CVEID:CVE-2025-1411 DESCRIPTION: IBM Security Verify Directory Container could allow a local user to execute commands as root due to execution with unnecessary privileges...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an out-of-bounds read in Linux kernel's USB Audio driver [CVE-2024-53150]

Summary IBM Watson Speech Services Cartridge is vulnerable to an out-of-bounds read in Linux kernel's USB Audio driver, due to a failure to check bLength of each descriptor at traversing for clock descriptors CVE-2024-53150. Linux kernel's USB Audio driver is used in our speech microservices. Thi...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a stack overflow vulnerability in libexpat library [CVE-2024-8176]

Summary IBM Watson Speech Services Cartridge is vulnerable to a stack overflow vulnerability in libexpat library, due to the way it handles recursive entity expansion in XML documents CVE-2024-8176. The libexpat library is used as part of our speech utilities. This vulnerabilitiy has been...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a sensitive header drop in Golang/net/http [CVE-2024-45336]

Summary IBM Watson Speech Services Cartridge is vulnerable to a sensitive header drop in Golang/net/http, which can occour following a cross-domain redirect CVE-2024-45336. The Golang/net/http package is used as part of our speech utilities. This vulnerabilitiy has been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a sensitive information exposure in Golang crypto/internal/nistec [CVE-2025-22866]

Summary IBM Watson Speech Services Cartridge is vulnerable to a sensitive information exposure in the Golang crypto/internal/nistec package, due to the usage of a variable time instruction in the assembly implementation of an internal function, which may allow a small number of bits of secret...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to certification errors in golang.org/x/crypto/ssh [CVE-2024-45341]

Summary IBM Watson Speech Services Cartridge is vulnerable to certification errors in golang.org/x/crypto/ssh, because of conditions which incorrectly satisfy a URI name constraint that applies to certificate chains. CVE-2024-45341. Golang.org/x/crypto/ssh is used as part of our speech utilities...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in golang.org/x/crypto/ssh [CVE-2025-22869]

Summary IBM Watson Speech Services Cartridge is vulnerable to a denial of service in golang.org/x/crypto/ssh, due to a flaw in SSH servers which implement file transfer protocols CVE-2025-22869. Golang.org/x/crypto/ssh is used as part of our speech utilities. This vulnerabilitiy has been addresse...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an arbitrary code execution in Jinja [CVE-2025-27516]

Summary IBM Watson Speech Services Cartridge is vulnerable to arbitrary code execution in Jinja, due to an oversight in how the Jinja sandboxed environment interacts with the |attr filter CVE-2025-27516. Jinja is used in our speech runtimes. This vulnerabilitiy has been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a' use after free' condition in libxml2 [CVE-2024-56171]

Summary IBM Watson Speech Services Cartridge is vulnerable to a' use after free' condition due to a flaw in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c CVE-2024-56171. libxml2 is used as part of our speech utilities. This vulnerabilitiy has been addressed. Please...