Security Bulletin: IBM Robotic Process Automation is vulnerable to disclosure of information that could aid in further system attacks. (CVD-2022-38710)

Summary IBM Robotic Process Automation could potentially expose system and software version information which could aid in further system attacks. Vulnerability Details CVEID:CVE-2022-38710 DESCRIPTION: IBM Robotic Process Automation could disclose sensitive version information that could aid in...

PT-2025-12980 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2024.3.29 and earlier, Devolutions Remote Desktop Manager versions 2025.1.24 through 2025.1.25 Description: The issue is related to improper authorization in the application password policy, allowin...

PT-2025-13007 · Unknown +1 · Ingress-Nginx +2

Name of the Vulnerable Software and Affected Versions: KNIME Business Hub versions prior to 1.10.4 KNIME Business Hub versions prior to 1.11.4 KNIME Business Hub versions prior to 1.12.4 KNIME Business Hub versions prior to 1.13.3 Description: The issue affects the ingress-nginx component,...

PT-2025-12999 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.7 through 17.8.6 GitLab CE/EE versions 17.9 through 17.9.3 GitLab CE/EE versions 17.10 through 17.10.1 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9...

PT-2025-13164 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.03 Description: The issue concerns the potential exposure of a base64 encoded password in the build log. Recommendations: For versions prior to 2025.03, update to version 2025.03 or later to resolve t...

JVN#39026557: Multiple vulnerabilities in PowerCMS

PowerCMS provided by Alfasado Inc. contains multiple vulnerabilities listed below. Injection CWE-74 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Base Score 5.3 CVE-2025-29993 The product improperly processes HTTP headers. Dependency on vulnerable third-party component CWE-1395 jQuery Validation...

PT-2025-12998

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 1.52 Description An issue was discovered in Appsmith where an incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must...

PT-2025-12986 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2024.3.29 and earlier Devolutions Remote Desktop Manager versions 2025.1.24 through 2025.1.25 Description: The issue is related to improper authorization in the variable component, allowing an...

RHSA-2025:3123 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Bulletin has no description...

RHSA-2025:3111 Red Hat Security Advisory: fence-agents security update

Bulletin has no description...

PT-2025-12758 · Unknown · Stylish Google Sheet Reader

Name of the Vulnerable Software and Affected Versions: Stylish Google Sheet Reader 4.0 WordPress plugin versions 4.0 through 4.0 Description: The issue is related to a Reflected Cross-Site Scripting that could be used against high privilege users, such as administrators. This occurs because the...

PT-2025-16745

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.14.0-rc4 Description A vulnerability in the Linux kernel has been resolved. The issue is related to the bonding mode and xdp program attachment. When the namespace is deleted, the dev xdp uninstall function is...

PT-2025-12741 · WordPress · Wp-Advanced-Search

Name of the Vulnerable Software and Affected Versions: WP-Advanced-Search versions prior to 3.3.9.3 Description: The issue concerns the WordPress WP-Advanced-Search plugin, where some settings are not properly sanitized and escaped. This could allow high-privilege users, such as admins, to perfor...

PT-2025-12810

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.89.0 Frappe versions prior to 15.51.0 Description The issue allows for information disclosure through crafted requests, potentially leading to account takeover. Recommendations For versions prior to 14.89.0, update ...

JVN#26321838: Multiple vulnerabilities in AssetView

AssetView provided by Hammock Corporation contains multiple vulnerabilities listed below. Missing authentication for critical function CWE-306 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Base Score 8.2 CVE-2025-25060 Acquiring sensitive information from sent data to the developer CWE-201...

PT-2025-12817 · Wp01 · Wp01

Name of the Vulnerable Software and Affected Versions: WP01 versions prior to 2.6.2 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in wp01ru WP01. Recommendations: For versions pri...

OPENSUSE-SU-2025:14925-1 kubernetes1.30-apiserver-1.30.11-1.1 on GA media

These are all security issues fixed in the kubernetes1.30-apiserver-1.30.11-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:14924-1 kubernetes1.29-apiserver-1.29.15-1.1 on GA media

These are all security issues fixed in the kubernetes1.29-apiserver-1.29.15-1.1 package on the GA media of openSUSE Tumbleweed...

MGASA-2025-0113 Updated wpa_supplicant & hostapd packages fix security vulnerability

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail. CVE-2025-24912...

PT-2025-12764

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.x through 2.28.9 Mbed TLS versions 3.x through 3.6.2 Description The issue allows servers with trusted certificates for arbitrary hostnames to be accepted by the client unless the TLS client application calls mbedtls ssl se...