12577 matches found
CVE-2025-24962
reNgine suffers a command-injection vulnerability in which an attacker could inject commands via the nmap_cmd parameter. This is confirmed across multiple sources (e.g., Red Hat CVE entry, OSV, CVE list, and other feeds) and is described as being addressed in commit c28e5c8d with a fix to be incl...
CVE-2025-24962 Command Injection in reNgine
reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmapcmd parameters. This issue has been addressed in commit c28e5c8d and is expected in the next versioned release. Users are advised to filter user input and monitor the...
SUSE-SU-2025:0346-1 Security update for ignition
This update for ignition fixes the following issues: CVE-2023-45288: Fixed unclosed connections when receiving too many headers in golang.org/x/net/http2 bsc1236518...
OPENSUSE-SU-2025:14723-1 google-osconfig-agent-20250115.01-1.1 on GA media
These are all security issues fixed in the google-osconfig-agent-20250115.01-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2025-5394 · Unknown · Alexandros Georgiou Bitcoin/Altcoin Wallets
Name of the Vulnerable Software and Affected Versions: Alexandros Georgiou Bitcoin and Altcoin Wallets versions prior to 6.3.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-site Scripting XSS attacks, specifically Reflecte...
HP Anyware Agent for Linux – Potential Authentication Bypass
A potential vulnerability has been identified in HP Anyware Agent for Linux which might allow for authentication bypass, which might result in escalation of privilege. HP is releasing a software update to mitigate this potential vulnerability. Update your version of HP Anyware Agent for Linux to...
PT-2025-5606 · Rengine · Rengine
Name of the Vulnerable Software and Affected Versions: reNgine affected versions not specified Description: The issue allows a user to inject commands via the nmap cmd parameters. This is a command injection issue in the reNgine automated reconnaissance framework for web applications. Users are...
PT-2025-5482 · Woocommerce · Taxi Booking Manager For Woocommerce
Name of the Vulnerable Software and Affected Versions: Taxi Booking Manager for WooCommerce versions 1.1.8 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially be exploited by injecting malicious objects into the...
PT-2025-4755 · Eladmin · Eladmin
Name of the Vulnerable Software and Affected Versions: eladmin versions =2.7 Description: The issue concerns CSV injection in the exception log download module. This allows for potential data manipulation or extraction. No information is provided about the estimated number of affected devices or...
PT-2025-4628 · Unknown · Contest Gallery
Name of the Vulnerable Software and Affected Versions: Contest Gallery versions prior to 25.1.0 Description: The issue is related to improper neutralization of special elements used in an SQL command, which allows SQL injection. This means that an attacker could potentially inject malicious SQL...
PT-2025-5615 · Unknown · Ckeditor 5 +1
Name of the Vulnerable Software and Affected Versions: Backdrop CMS versions 1.28.x through 1.28.4 Backdrop CMS versions 1.29.x through 1.29.2 Description: A cross-site scripting XSS issue was discovered in Backdrop CMS when using the CKEditor 5 rich text editor. The issue arises because the syst...
CVE-2024-11741
Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15...
[SECURITY] Fedora 41 Update: java-21-openjdk-21.0.6.0.7-1.fc41
The OpenJDK 21 runtime environment...
PT-2025-2075
Name of the Vulnerable Software and Affected Versions Fantastic ElasticSearch WordPress plugin versions 4.1.0 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitized and escaped before being outputted back i...
PT-2025-1999 · WordPress · Opsi Israel Domestic Shipments
Name of the Vulnerable Software and Affected Versions: OPSI Israel Domestic Shipments WordPress plugin versions 2.6.3 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputt...
PT-2025-2758 · Ibm · Ibm Sterling B2B Integrator
Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator versions 6.0.0.0 through 6.1.2.5 IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.3 Description: The issue allows a privileged user to embed arbitrary JavaScript code in the Web UI, altering the intended...
DLA-4038-1 dcmtk - security update
Bulletin has no description...
OPENSUSE-SU-2025:14719-1 bind-9.20.5-1.1 on GA media
These are all security issues fixed in the bind-9.20.5-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2025-2080
Name of the Vulnerable Software and Affected Versions A5 Custom Login Page WordPress plugin versions 2.8.1 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in t...