JVN#48742353: Multiple cross-site scripting vulnerabilities in Movable Type

Movable Type provided by Six Apart Ltd. contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor CWE-79 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score 5.4 CVE-2025-22888 Stored cross-si...

JVN#91300609: RevoWorks SCVX and RevoWorks Browser vulnerable to incorrect resource transfer between spheres

RevoWorks SCVX and RevoWorks Browser provided by J’s Communication Co., Ltd. build a sandbox environment isolated from a server or a client's local environment. These products provide the function enabling execution of sanitizing files when downloading files from the sandbox environment to the...

PT-2025-15607 · Bridge · Bridge

Name of the Vulnerable Software and Affected Versions: Bridge versions 14.1.5, 15.0.2 and earlier Description: The issue is a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction, where a...

Security Bulletin: A Security Vulnerability was discovered in IBM Security Verify Directory (CVE-2024-45650)

Summary A Security Vulnerability was addressed in IBM Security Verify Directory. Vulnerability Details CVEID:CVE-2024-45650 DESCRIPTION: IBM Security Verify Directory 10.0 is vulnerable to a denial of service when sending an LDAP extended operation. CWE:CWE-754: Improper Check for Unusual or...

SUSE-SU-2025:0581-1 Security update for buildah

This update for buildah fixes the following issues: - CVE-2023-45288: possible excessive CPU consumption due to no limit being set on the number of CONTINUATION frames read for an HTTP/2 request in golang.org/x/net/http2. bsc1236531...

SUSE-SU-2025:0574-1 Security update for emacs

This update for emacs fixes the following issues: - CVE-2025-1244: improper handling of custom 'man' URI schemes allow for shell command injections. bsc1237091...

DLA-4057-1 openssh - security update

Bulletin has no description...

RHSA-2025:1515 Red Hat Security Advisory: idm:DL1 security update

Bulletin has no description...

CVE-2025-1302

A flaw was found in jsonpath-plus. This vulnerability allows remote code execution RCE via improper input sanitization, exploiting the unsafe default usage of eval='safe' mode. Mitigation Red Hat Product Security recommends updating the vulnerable software to the latest version...

PT-2025-7168

Name of the Vulnerable Software and Affected Versions OpenSSH versions 6.8p1 through 9.9p1 Description A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled, allowing a machine-in-the-middle attack to be performed by a malicious machine impersonating a legitimate server...

PT-2025-6740

Name of the Vulnerable Software and Affected Versions Das U-Boot versions prior to 2025.01-rc1 Description The issue is related to an integer overflow in the sqfs inode size function, which occurs during the calculation of the symlink size via a crafted squashfs filesystem. This can be exploited...

Automated Logic WebCTRL Premium Server Unrestricted Upload of File with Dangerous Type (CVE-2024-8525)

CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists which could allow an unauthenticated user to upload files of dangerous types without restrictions, leading to remote command execution. This plugin only works with Tenable.ot. Please visit...

JVN#26024080: Multiple vulnerabilities in The LuxCal Web Calendar

The LuxCal Web Calendar provided by LuxSoft contains multiple vulnerabilities listed below. SQL injection in pdf.php CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Base Score 7.3 CVE-2025-25221 SQL injection in retrieve.php CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Base Score 7.3...

OPENSUSE-SU-2025:14814-1 obs-service-cargo-4.5.0-2.1 on GA media

These are all security issues fixed in the obs-service-cargo-4.5.0-2.1 package on the GA media of openSUSE Tumbleweed...

DLA-4055-1 trafficserver - security update

Bulletin has no description...

Advisory ROSA-SA-2025-2695

Software: shim 15.6 OS: ROSA Virtualization 3.0 packageevrstring: shim-15.6 CVE-ID: CVE-2023-40547 BDU-ID: 2024-00725 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability exists in the shim UEFI bootloader due to failure to take measures to neutralize special elements. Exploitation of the vulnerability...

Advisory ROSA-SA-2025-2693

Software: pcre2 10.34 OS: ROSA Virtualization 3.0 packageevrstring: pcre2-10.34-9.0.3 CVE-ID: CVE-2022-1586 BDU-ID: 2022-03770 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the compilexclassmatchingpath function of the PCRE2 library is related to reading data beyond buffer boundaries in memory...

Advisory ROSA-SA-2025-2686

Software: openldap 2.4.46 OS: ROSA Virtualization 3.0 packageevrstring: openldap-2.4.46-18.0.1 CVE-ID: CVE-2022-29155 BDU-ID: 2022-03203 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the OpenLDAP protocol implementation is related to failure to take measures to protect the SQL query structure...

Advisory ROSA-SA-2025-2683

Software: grub2 2.02 OS: ROSA Virtualization 3.0 packageevrstring: grub2-2.02-148.0.3 CVE-ID: CVE-2022-2601 BDU-ID: 2022-06819 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the grubfontconstructglyph function of the Grub2 operating systems boot loader is related to an operation exceeding buffer...

Advisory ROSA-SA-2025-2687

Software: pango 1.42.4 OS: ROSA Virtualization 3.0 packageevrstring: pango-1.42.4-8 CVE-ID: CVE-2019-1010238 BDU-ID: 2019-02871 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the pangolog2visgetembeddinglevels function of the Pango library is related to an operation exceeding buffer boundaries...