SignXML's signature verification with HMAC is vulnerable to a timing attack

When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., prior versions of SignXML are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing...

WordPress ShiftNav – Responsive Mobile Menu plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin ShiftNav – Responsive Mobile Menu versions = 1.8...

PT-2025-23953 · Code Projects · Patient Record Management System

Name of the Vulnerable Software and Affected Versions: code-projects Patient Record Management System version 1.0 Description: A critical issue was found in the Patient Record Management System, affecting some unknown functionality of the file urinalysis form.php. The manipulation of the urinalys...

PT-2025-23897

Name of the Vulnerable Software and Affected Versions Qt versions 6.3.0 through 6.5.9 Qt versions 6.6.0 through 6.8.4 Qt version 6.9.0 Description The issue occurs when a specifically crafted ICNS format image file is loaded in QImage, triggering a crash. Recommendations For Qt versions 6.3.0...

PT-2025-23930 · Devolutions · Devolutions Server

Name of the Vulnerable Software and Affected Versions: Devolutions Server versions 2025.1.10.0 and earlier Description: The issue is related to improper access control in the Tor network blocking feature. This allows an authenticated user to bypass the Tor blocking feature when the Devolutions...

CVE-2025-48934 Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the Deno.env.toObject method ignores any variables listed in the --deny-env option of the deno run command. When looking at the documentation of the --deny-env option this might lead to a false...

CVE-2025-1701 Local Privilege Escalation in MIM Admin Service

CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially crafted request over the RMI interface to execute arbitrary code with the privileges of the MIM Admin service. The RMI interface is only accessible locally...

CVE-2025-49223

billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

PT-2025-23796 · Unknown · Airleader Master

Name of the Vulnerable Software and Affected Versions: airleader MASTER version 3.00571 Description: The issue is related to an Improper Authentication vulnerability that allows Authentication Bypass. This vulnerability affects the airleader MASTER device, potentially allowing unauthorized access...

CVE-2025-46204

An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/id endpoint...

PT-2025-23750

Name of the Vulnerable Software and Affected Versions Fingerprint trustlet versions prior to SMR May-2025 Release 1 Description The issue is an out-of-bounds read in the fingerprint trustlet, allowing local privileged attackers to read out-of-bounds memory. Recommendations For versions prior to S...

PT-2025-23841

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.1.13 and prior to 2.2.13 Description The issue affects Deno, a JavaScript, TypeScript, and WebAssembly runtime. It involves the Deno.env.toObject method, which ignores variables listed in the --deny-env option of the...

CVE-2025-24015 Deno's AES GCM authentication tags are not verified

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in Deno in which the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the...

GO-2025-3728 Mattermost fails to properly enforce access control restrictions for System Manager roles in github.com/mattermost/mattermost-server

Mattermost fails to properly enforce access control restrictions for System Manager roles in github.com/mattermost/mattermost-server...

CVE-2025-25019 IBM QRadar Suite Software and IBM Cloud Pak for Security session fixation

IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate another user on the system...

BIT-DRUPAL-2024-11942 Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

BELL-CVE-2025-47808

Bulletin has no description...

BELL-CVE-2025-47806

Bulletin has no description...

PT-2025-23630 · Ibm · Ibm Qradar Suite +1

Name of the Vulnerable Software and Affected Versions: IBM QRadar Suite Software versions 1.10.12.0 through 1.11.2.0 IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0 Description: The issue allows an unauthenticated user in the environment to obtain highly sensitive information in...

PT-2025-23671

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.10 Description DataEase is an open source business intelligence and data visualization tool. A flaw exists in a previous patch that allows it to be bypassed through case insensitivity because the prohibited term...