nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After Discovery

New research has uncovered continued risk from a known security weakness in Microsoft's Entra ID, potentially enabling malicious actors to achieve account takeovers in susceptible software-as-a-service SaaS applications. Identity security company Semperis, in an analysis of 104 SaaS applications,...

CVE-2025-47725 Out-of-bounds Write in CNCSoft

Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process...

CVE-2023-31759

Weak Security in the 433MHz keyfob of Kerui W18 Alarm System v1.0 allows attackers to gain full access via a code replay attack...

CVE-2023-38738

IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is using Native authentication an attacker with access to the OpenPages database could through a series of specially crafted steps could exploit...

CVE-2023-43018

IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: 266163...

The vulnerability of the /adv_arpspoofing.php file, a component of the ARP Spoofing Prevention software for D-Link DAP-2695 wireless access points, allows attackers to execute cross-site scripting attacks.

The vulnerability of the /advarpspoofing.php file, a component of the ARP Spoofing Prevention software for D-Link DAP-2695 wireless access points, is related to the lack of security measures for the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site...

CVE-2022-33097

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/campus/campusjob...

CVE-2025-4280

Poedit on macOS is affected by CVE-2025-4280 due to a bundled Python interpreter inheriting the app’s TCC permissions. A local attacker can invoke the interpreter to run arbitrary commands using those granted permissions to access files in privacy-protected folders without user prompts, potential...

CVE-2019-15496

MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page...

tranport: TLS host name wildcard matching too lax

...

CVE-2025-27468 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

...

Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to spring-context-6.1.11.jar CVE-2024-38820

Summary IBM Maximo Application Suite - Monitor Component is vulnerable to spring-context-6.1.11.jar CVE-2024-38820. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-38820 DESCRIPTION: VMware Tanzu Spring Framework could provide weaker...

CVE-2025-3295

creationtimestamp| type| source ---|---|--- 2025-04-17 05:57:32+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/12191 2025-04-17 06:48:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmyj7gz55g2u 2025-04-17 10:28:11+00:00| seen| https://t.me/cvedetector/23216...

GHSA-56P6-QW3C-FQ2G Suspended Directus user can continue to use session token to access API

Summary Since the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to access the API despite their status. Details There is a check missing in verifySessionJWT to verify that a user is actually still active and allowed to...

CVE-2025-2493

creationtimestamp| type| source ---|---|--- 2025-03-18 11:55:39+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/7903 2025-03-18 13:01:22+00:00| seen| Telegram/6cbUuW0XOy9-5cfzVYZy-1D70VP0VBBmnHLM6kTk1XKO28 2025-03-18 16:03:53+00:00| seen| https://t.me/cvedetector/20568 2025-03-18 16:13:23+00:0...

Linux Distros Unpatched Vulnerability : CVE-2022-49698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfilter: use getrandomu32 instead of prandom bh might occur while updating per-cpu rndstat...

Linux Distros Unpatched Vulnerability : CVE-2016-7042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The prockeysshow function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection gcc stack protector is enabled, uses an...

CVE-2025-0510

Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135...

CVE-2024-10603

Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in some circumstances...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security weakness in Certifi python-certifi [CVE-2024-39689]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security weakness in Certifi python-certifi, caused by the use of GLOBALTRUST root certificate CVE-2024-39689. Certifi python-certifi is used by our Speech Service runtimes. This vulnerabilitiy has been...