go-toolset:ol8 security update

delve 1.24.1-1.0.1 - Disable DWARF compression which has issues Alex Burmashev golang 1.23.9-1 - Update to Go 1.23.9 - Resolves: RHEL-94636 go-toolset 1.23.9-1 - Update to Go 1.23.9 - Resolves: RHEL-94636...

SAMSUNG SMR 安全漏洞

SAMSUNG SMR is a system patch package from the South Korean company Samsung SAMSUNG. It provides patches for Samsung cell phone applications. A security vulnerability exists in versions prior to SAMSUNG SMR Jun-2025 Release 1, which stems from improper export of Android application components and...

WordPress Spare Theme <= 1.7 is vulnerable to Cross Site Scripting (XSS)

Software Spare Type Theme Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31638 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7f04b8ce15e4 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

PT-2025-23790 · Unknown · Codeastro Real Estate Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro Real Estate Management System version 1.0 Description: A critical issue affects the processing of the file /profile.php. The manipulation of the content argument leads to SQL injection. The attack can be initiated remotely. An explo...

WordPress FancyBox for WordPress plugin < 3.3.6 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pierre Rudloff, Marc Montpas in WordPress Plugin FancyBox for WordPress versions 3.3.6...

WordPress Newsletter plugin < 8.8.2 - Admin+ Stored XSS via Subscription vulnerability

Admin+ Stored XSS via Subscription vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin NewsLetter versions 8.8.2...

CVE-2025-48999 Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability

DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a malicious payload, getUrlType retrieves hostName. Since the judgment statement returns false, it will not enter the if statement and will not ...

CVE-2025-48953

Umbraco is an ASP.NET content management system CMS. Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and...

CVE-2025-48998 Dataease MYSQL JDBC File Reading Vulnerability

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27103 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.10. ...

CVE-2025-48953

Umbraco CMS (ASP.NET) has a file-upload bypass vulnerability: in versions 14.0.0 up to but not including 15.4.2 and 16.0.0, an API request can be manipulated to upload a file that doesn’t conform to the configured allowed extensions. The issue is fixed in 15.4.2 and 16.0.0. There are no publicly ...

CVE-2025-30359 webpack-dev-server users' source code may be stolen when they access a malicious web site

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same...

CVE-2025-30359 webpack-dev-server users' source code may be stolen when they access a malicious web site

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same...

quic-go Has Panic in Path Probe Loss Recovery Handling

Impact The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to trigger a nil-pointer dereference by a malicious QUIC client. In order to do so, the attacker first sends valid QUIC packets from different remote addresses thereby triggering the newly adde...

PT-2025-23873 · D Link · D-Link Dir-816

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 version 1.10CNB05 Description: A critical issue has been discovered, affecting the qosClassifier function of the file /goform/qosClassifier. The manipulation of the arguments dip address and sip address leads to os command...

PT-2025-23872 · D Link · D-Link Dir-816

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 version 1.10CNB05 Description: A critical issue was found in the function setipsec config of the file /goform/setipsec config. The manipulation of the arguments localIP and remoteIP leads to os command injection. It is possible...

PT-2025-23622 · Unicom · Unicom Focal Point

Name of the Vulnerable Software and Affected Versions: Unicom Focal Point version 7.6.1 Description: A Cross Site Scripting issue was found. The val parameter in SettingController for the "/fp/admin/settings/loginpage" endpoint and the rootserviceurl parameter in FriendsController for the...

CVE-2025-48996 Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint

HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the haxPsuUsage API endpoint, related to a flat...

CVE-2025-47272

The CE Phoenix eCommerce platform, starting in version 1.0.9.7 and prior to version 1.1.0.3, allowed logged-in users to delete their accounts without requiring password re-authentication. An attacker with temporary access to an authenticated session e.g., on a shared/public machine could...

CVE-2025-48494

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens...

CVE-2025-5455 Possible denial of service when passing malformed data in a URL to qDecodeDataUrl

An issue was found in the private API function qDecodeDataUrl in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value such as...