CVE-2025-23292

Summary : CVE-2025-23292 affects NVIDIA Delegated Licensing Service (DLS) for all appliance platforms. The vulnerability is a SQL injection in the DLS component that could allow an attacker to perform an unauthorized action, with potential partial denial of service affecting the UI. The CVSSv3.1 ...

Security Bulletin: IBM webMethods Integration is affected by vulnerable swagger-ui library

Summary IBM webMethods Integration - Designer Service Development is affected by vulnerable swagger-ui library. CVE-2018-25031/CWE-20 Vulnerability Details CVEID:CVE-2018-25031 DESCRIPTION: Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a...

Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.7.0 release

Red Hat OpenShift distributed tracing platform Tempo 3.7.0 has been released This release of the Red Hat OpenShift distributed tracing platform Tempo provides new features, security improvements, and bug fixes. Breaking changes: Nothing Deprecations: Nothing Technology Preview features: Nothing...

CVE-2025-57769 FressRSS: Clickjacking can lead to XSS and/or privilege escalation

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possibl...

CVE-2025-34211

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 VA and SaaS deployments contain a private SSL key and matching public certificate stored in cleartext. The key belongs to the hostname pl‑local.com and is used by the...

CVE-2025-30247

An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system commands via a specially crafted HTTP POST...

CVE-2025-36352 IBM License Metric Tool cross-site scripting

IBM License Metric Tool 9.2.0 through 9.2.40 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessi...

CVE-2025-36239

IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2025-36239 IBM Storage TS4500 Library cross-site scripting

IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

MAL-2025-47839 Malicious code in @my-pvz/ui-kit (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cdc756704726b9cfb66ba52746b5d42a7b6f8742370a8bf409a664879607281 Any computer that has this package installed or running should be considered...

Malicious code in @my-pvz/ui-kit (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cdc756704726b9cfb66ba52746b5d42a7b6f8742370a8bf409a664879607281 Any computer that has this package installed or running should be considered...

GHSA-Q475-2PGM-7HVP Apache Airflow: Connection sensitive details exposed to users with READ permissions

Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values. In Airflow 3.0.3, this model was...

PYSEC-2025-85

Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values.In Airflow 3.0.3, this model was unintentional...

CVE-2025-54831 Apache Airflow: Connection sensitive details exposed to users with READ permissions

Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values. In Airflow 3.0.3, this model was...

MAL-2025-47853 Malicious code in mshops-seo-ui (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a20413648a583ca4070aa60c80b8be68d2a92a57d9d96169aacc20916df718b Any computer that has this package installed or running should be considered...

Malicious code in mshops-seo-ui (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a20413648a583ca4070aa60c80b8be68d2a92a57d9d96169aacc20916df718b Any computer that has this package installed or running should be considered...

PT-2025-39520

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.0.0 through 3.0.3 Description A change in Apache Airflow 3 introduced a "write-only" model for sensitive connection information, intended to restrict access to Connection Editing Users. However, in version 3.0.3, this...

PT-2025-39703

Name of the Vulnerable Software and Affected Versions IBM Storage TS4500 Library versions 1.11.0.0 and 2.11.0.0 Description The IBM Storage TS4500 Library is susceptible to a cross-site scripting issue. An unauthenticated attacker can inject arbitrary JavaScript code into the Web UI, potentially...

CVE-2025-20240

A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack XSS on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could...

MAL-2025-47534 Malicious code in @sev-ui-verse/event-bus (npm)

The package @sev-ui-verse/event-bus was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2e7a58185f216b62d263ee5e9e75c527755dab55a83fcaf06401463b8bccabc Any computer that has this package installed or running should be considered ful...