12715 matches found
PT-2025-27871 · Long Watch Studio · Myrewards
Name of the Vulnerable Software and Affected Versions: Long Watch Studio MyRewards versions n/d through 5.4.13.1 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. Recommendations: For...
PT-2025-28022 · Zipkin +1 · Zipkin +1
Name of the Vulnerable Software and Affected Versions: Zipkin versions prior to 3.5.2 Description: The issue is related to the exposure of heap dump information through the "/heapdump" endpoint, which is associated with the use of Spring Boot Actuator. This endpoint is similar to a previously...
Fixed in Apache Tomcat 9.0.107
Important: APR/Native Connector crash leading to DoS CVE-2025-52434 A race condition on connection close could trigger a JVM crash when using the APR/Native connector leading to a DoS. This was particularly noticeable with client initiated closes of HTTP/2 connections. This was fixed with commit...
PT-2025-27893 · Woocommerce · Trust Payments Gateway For Woocommerce
Name of the Vulnerable Software and Affected Versions: Trust Payments Gateway for WooCommerce JavaScript Library versions 1.3.6 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows unauthorized actions to be performed on behalf of a user. This c...
WordPress Premium Addons for Elementor plugin <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Premium Addons for Elementor versions = 4.10.69...
CGA-7GHH-G6R5-CH5H
Bulletin has no description...
RHSA-2025:10258 Red Hat Security Advisory: xorg-x11-server-Xwayland security update
Bulletin has no description...
RHSA-2025:10220 Red Hat Security Advisory: glibc security update
Bulletin has no description...
PT-2025-27785 · Endress+Hauser · Endress+Hauser Meac300-Fnade4
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The login mechanism of the affected system does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to...
PT-2025-27822 · Unknown · Wpcenter Aibud Wp
Name of the Vulnerable Software and Affected Versions: WPCenter AiBud WP versions 1.8.5 and earlier Description: The issue affects WPCenter AiBud WP, allowing an unrestricted upload of a file with a dangerous type, which enables uploading a web shell to a web server. Recommendations: For versions...
PT-2025-27793 · Undefined · Undefined
🚨 Critical Signature Malleability Vulnerability in Ethereum crate - CVE-2025-194575. Update to version 0.18.0 or later to mitigate risks related to EIP-2930, EIP-1559, and EIP-7702 transactions. 🔧 Read more: https://t.co/8nUYoL3dHP https://t.co/0mwkmbEjq7...
PT-2025-27836 · Next.Js · Next.Js
Name of the Vulnerable Software and Affected Versions: Next.js versions 15.0.4-canary.51 through 15.1.7 Description: Next.js is susceptible to a cache poisoning issue that can lead to a Denial of Service DoS condition. This flaw allows attackers to manipulate the caching of HTTP responses,...
Fedora 42 : thunderbird (2025-013f8d6631)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-013f8d6631 advisory. Update to 128.9.2 https://www.thunderbird.net/en-US/thunderbird/128.9.0esr/releasenotes/...
SUSE SLES15: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-SUSE-RU-2025:02203-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2025:02203-1 advisory. - Fix idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243859 - Update to version 1.4.2 - Update...
Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability
A vulnerability in the web UI of Cisco Enterprise Chat and Email ECE could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An...
CVE-2025-53108 HomeBox Missing User Authorization
HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in the API endpoints responsible for updating and deleting inventory item attachments. This flaw allows authenticated users to perform unauthorized actions on inventory item...
SUSE-RU-2025:02204-1 Recommended update for aws-nitro-enclaves-cli
This update for aws-nitro-enclaves-cli fixes the following issues: - Fix idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243859 - Update to version 1.4.2 - Update aws-nitro-enclaves-sdk-bootstrap to version f718dea6 - Update to version 1.3.3git0.afb7264 - Update...
SUSE-RU-2025:02203-1 Recommended update for aws-nitro-enclaves-cli
This update for aws-nitro-enclaves-cli fixes the following issues: - Fix idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243859 - Update to version 1.4.2 - Update aws-nitro-enclaves-sdk-bootstrap to version f718dea6 - Update to version 1.3.3git0.afb7264 - Update...