Security Bulletin: NVIDIA Hopper HGX 8-GPU HMC - March 2025

NVIDIA has released a software update for NVIDIA® Hopper HGX 8-GPU HMC. To protect your system, download and install the appropriate firmware update. Go to NVIDIA Product Security. Details This section provides a summary of potential vulnerabilities that this security update addresses and their...

PT-2025-9700 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 6.7.0 Description: The issue allows for path traversal, which may enable remote code execution using a privileged account, requiring a device admin account. This cannot be performed by a regular user. In combinatio...

PT-2025-9660 · Mozilla +10 · Firefox +10

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 136 Firefox ESR versions prior to 128.8 Description: A web page could trick a user into setting that site as the default handler for a custom URL protocol. Recommendations: For Firefox versions prior to 136, update t...

PT-2025-9684 · Unknown · Xxyopen Novel-Plus

Name of the Vulnerable Software and Affected Versions: xxyopen novel plus versions prior to 4.4.0 Description: The issue allows a remote attacker to execute arbitrary code via the PageController.java file. Recommendations: For versions prior to 4.4.0, update to a version that contains a fix for...

CVE-2025-27419 Denial of Service (DoS) in WeGIA due to Recursive Crawling of Dynamic URLs

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service DoS vulnerability exists in WeGIA. This vulnerability allows any unauthenticated user to cause the server to become unresponsive by performing aggressive spidering. The vulnerabilit...

CVE-2025-27417 WeGIA Contains a Stored Cross-Site Scripting (XSS) in 'adicionar_status_atendido.php' via the 'status' parameter

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarstatusatendido.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into...

CVE-2025-27410

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included .js file and restarting the...

Advisory ROSA-SA-2025-2750

Software: libtiff 4.0.9 OS: ROSA Virtualization 2.1 packageevrstring: libtiff-4.0.9-33.rv3 CVE-ID: CVE-2018-15209 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in LibTIFF allows remote attackers to cause a denial of service or execute arbitrary code via a specially crafted TIFF file...

Advisory ROSA-SA-2025-2749

Software: gnutls 3.6.16 OS: ROSA Virtualization 2.1 packageevrstring: gnutls-3.6.16-8.0.1.rv3.1 CVE-ID: CVE-2023-5981 BDU-ID: 2024-01500 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the GnuTLS transport layer security library is related to information disclosure via a mismatch. Exploitation of...

Advisory ROSA-SA-2025-2747

Software: wget 1.19.5 OS: ROSA Virtualization 3.0 packageevrstring: wget-1.19.5-12.0.1.rv30 CVE-ID: CVE-2024-38428 BDU-ID: 2024-04683 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the userinfo URI component of the GNU Wget download manager is related to insecure behavior in which data that shoul...

Advisory ROSA-SA-2025-2745

Software: python3x-idna 2.10 OS: ROSA Virtualization 3.0 packageevrstring: python3x-idna-2.10-4.rv30 CVE-ID: CVE-2024-3651 BDU-ID: 2024-04211 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the idna.encode function of the Internationalized Domain Names in Applications IDNA is associated with...

Advisory ROSA-SA-2025-2739

Software: libvpx 1.7.0 OS: ROSA Virtualization 3.0 packageevrstring: libvpx-1.7.0-11.rv30 CVE-ID: CVE-2023-5217 BDU-ID: 2023-06157 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the VP8 format encoding function of the libvpx library of the Google Chrome browser is related to a buffer overflow ...

Advisory ROSA-SA-2025-2730

Software: openssl 1.1.1k OS: ROSA Virtualization 3.0 packageevrstring: openssl-1.1.1k-12.0.2.rv30 CVE-ID: CVE-2024-0727 BDU-ID: 2024-01337 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the PKCS12parse, PKCS12unpackp7data, PKCS12unpackp7encdata, PKCS12unpackauthsafes, and PKCS12newpass functions ...

Advisory ROSA-SA-2025-2724

Software: gnutls 3.6.16 OS: ROSA Virtualization 3.0 packageevrstring: gnutls-3.6.16-8.0.1.rv30.1 CVE-ID: CVE-2021-4209 BDU-ID: 2022-01898 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the implementation of the wrapnettlehashfast function of the GnuTLS cryptographic library is related to pointer...

Advisory ROSA-SA-2025-2723

Software: ghostscript 9.27 OS: ROSA Virtualization 3.0 packageevrstring: ghostscript-9.27-15.0.2.rv30 CVE-ID: CVE-2024-46951 BDU-ID: 2024-09419 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the psi/zcolor.c component of the Ghostscript document processing, conversion, and generation software suite...

PT-2025-9201 · Formwork · Formwork

Name of the Vulnerable Software and Affected Versions: Formwork versions 2.x Description: The site title field at "/panel/options/site" allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a...

PT-2025-9145 · WordPress · Simple:Press Forum Plugin

Name of the Vulnerable Software and Affected Versions: Simple:Press Forum plugin for WordPress versions prior to 6.10.12 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the sp save edited post function. This allows unauthenticated...

Fedora 40 : webkitgtk (2025-57805565ad)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-57805565ad advisory. Update to WebKitGTK 2.46.6: Fix a crash when enabling Skia CPU rendering. Fix several crashes and rendering issues. Fix CVE-2024-54543,...

DLA-4072-1 xorg-server - security update

Bulletin has no description...

PT-2025-9143 · WordPress · Buddypress Woocommerce My Account Integration

Name of the Vulnerable Software and Affected Versions: The BuddyPress WooCommerce My Account Integration plugin versions up to, and including, 3.4.24 Description: The issue is related to a missing capability check on the wc4bp delete page function, allowing authenticated attackers with...