CVE-2025-1421 Formula injection in a CSV file in Proget MDM

Data provided in a request performed to the server while activating a new device are put in a database. Other high privileged users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC...

RHSA-2025:8066 Red Hat Security Advisory: webkit2gtk3 security update

Bulletin has no description...

RHSA-2025:8064 Red Hat Security Advisory: webkit2gtk3 security update

Bulletin has no description...

RHSA-2025:8049 Red Hat Security Advisory: firefox security update

Bulletin has no description...

RHSA-2025:8021 Red Hat Security Advisory: libtasn1 security update

Bulletin has no description...

RHSA-2025:7995 Red Hat Security Advisory: webkit2gtk3 security update

Bulletin has no description...

PT-2025-22328 · WordPress · Affiliate Sales In Google Analytics/Other Tools

Name of the Vulnerable Software and Affected Versions: The Affiliate Sales in Google Analytics and other tools plugin for WordPress versions up to, and including, 1.4.9 Description: The issue is due to insufficient validation on the redirect url supplied via the afflink parameter. This makes it...

PT-2025-22509 · Infoblox · Infoblox Netmri

Name of the Vulnerable Software and Affected Versions: Infoblox NETMRI versions prior to 7.6.1 Description: The issue allows authenticated users to perform SQL injection attacks. Recommendations: For versions prior to 7.6.1, update to version 7.6.1 or later to resolve the issue...

PT-2025-22351 · Unknown · Konsola Proget

Name of the Vulnerable Software and Affected Versions: Konsola Proget versions prior to 2.17.5 Description: The issue is related to improper sanitization of input in the comment section of Konsola Proget, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack...

PT-2025-22487 · Infoblox · Infoblox Netmri

Name of the Vulnerable Software and Affected Versions: Infoblox NETMRI versions prior to 7.6.1 Description: The issue allows remote authenticated users to read arbitrary files with root access. Recommendations: For versions prior to 7.6.1, update to version 7.6.1 or later to resolve the issue...

PT-2025-22390 · Drupal · One Time Password

Name of the Vulnerable Software and Affected Versions: One Time Password versions 0.0.0 through 1.3.0 Description: The issue is related to an Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password, allowing remote services with stolen credentials. Recommendations: For O...

PT-2025-22477

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.2 through 17.10.6 GitLab CE/EE versions 17.11 through 17.11.2 GitLab CE/EE versions 18.0 through 18.0.0 Description An issue has been discovered in GitLab CE/EE due to a lack of input validation in the Kubernetes...

PT-2025-22386 · Drupal · Events Log Track

Name of the Vulnerable Software and Affected Versions: Events Log Track versions 0.0.0 through 3.1.10 Events Log Track versions 4.0.0 through 4.0.1 Description: The issue is related to the allocation of resources without limits or throttling in Drupal Events Log Track, allowing excessive...

GHSA-6FRX-J292-C844 TYPO3 Allows Privilege Escalation to System Maintainer

Problem Administrator-level backend users without system maintainer privileges can escalate their privileges and gain system maintainer access. Exploiting this vulnerability requires a valid administrator account. Solution Update to TYPO3 versions 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, 13.4.12...

CVE-2025-47290 Containerd vulnerable to host filesystem access during image unpack

containerd is a container runtime. A time-of-check to time-of-use TOCTOU vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0...

CVE-2025-47939

TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restrictio...

CVE-2025-47937 TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling

TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, when performing a database query involving multiple tables through the database abstraction layer DBAL, frontend...

RHSA-2025:7967 Red Hat Security Advisory: osbuild-composer security update

Bulletin has no description...

RHSA-2025:7893 Red Hat Security Advisory: grafana security update

Bulletin has no description...

PT-2025-22143 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions 12.x prior to 12.4.31 LTS TYPO3 versions 13.x prior to 13.4.2 LTS Description: The issue concerns the multifactor authentication MFA dialog presented during backend login, which can be bypassed due to insufficient enforcement o...