PT-2025-11964 · Applio +1 · Applio +1

Name of the Vulnerable Software and Affected Versions: Applio versions 3.2.8-bugfix and prior Description: Applio is a voice conversion tool vulnerable to unsafe deserialization in the model information.py file. The model name variable in model information.py accepts user-supplied input, such as ...

The vulnerability of Remote Desktop Services (RDS) for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of Remote Desktop Services RDS for Windows operating systems is related to the use of unsafe mechanisms for processing authentication data in the operating system’s memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the updatedajax method of the...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to arbitrary code execution due to redisson-3.17.7 (CVE-2023-42809)

Summary redisson is used by DataStage on Cloud Pak for Data as part of the Redis Java client. Vulnerability Details CVEID:CVE-2023-42809 DESCRIPTION: Redisson could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By persuading a victim to...

Prototype Pollution

Overview org.webjars.npm:parse-git-config is a Parse .git/config into a JavaScript object. sync or async. Affected versions of this package are vulnerable to Prototype Pollution via the expandKeys function. An attacker can obtain sensitive information by exploiting the improper handling of key...

WordPress plugin amoCRM WebForm 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin amoCR...

Remote Code Execution (RCE)

DGL is vulnerable to Remote Code Execution RCE.The vulnerability is due to unsafe deserialization due to the use of Python's pickle module for serializing and deserializing network messages, which can allow attackers to execute arbitrary code remotely...

Nintex Automation 代码问题漏洞

Nintex Automation is a workflow automation software from Nintex. A security vulnerability exists in Nintex Automation versions prior to 5.8 that stems from unsafe deserialization of user input...

VisiCut 代码问题漏洞

VisiCut is a tool by Thomas Oster, a personal developer. A security vulnerability exists in VisiCut version 2.1, which stems from unsafe XML deserialization in the loadPlfFile method of VisiCutModel.java, which could lead to code execution...

BIT-JENKINS-2025-27625

In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash \ characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as...

Unsafe Dependency Resolution

Overview python-json-logger is a JSON Log Formatter for the Python Logging Package Affected versions of this package are vulnerable to Unsafe Dependency Resolution through the deletion of a critical dependency which could be maliciously claimed by a third party. An attacker can execute arbitrary...

UBUNTU-CVE-2025-21830

In the Linux kernel, the following vulnerability has been resolved: landlock: Handle weird files A corrupted filesystem e.g. bcachefs might return weird files. Instead of throwing a warning and allowing access to such file, treat them as regular files...

CVE-2025-27625

In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash \ characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as...

CVE-2025-27625

CVE-2025-27625 affects Jenkins core up to version 2.499 and LTS up to 2.492.1. The issue: redirects that start with a backslash () are treated as safe, enabling phishing because browsers interpret them as scheme-relative redirects. This open-redirect condition can mislead users to a different sit...

CVE-2025-27625

In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash \ characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as...

Deserialization of Untrusted Data

Overview dgl is a Deep Graph Library Affected versions of this package are vulnerable to Deserialization of Untrusted Data in rpc.recvrequest, which is invoked in the startserver function in rpcserver.py without checking the contents of the payload. An attacker can execute code by sending malicio...

Improper Neutralization

Mongosh is vulnerable to Improper Neutralization. The vulnerability is due to improper output sanitization due to an attacker being able to inject control characters into shell output, potentially displaying falsified messages that mislead users into executing unsafe actions...

kernel: arm64: probes: Remove broken LDR (literal) uprobe support

In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Remove broken LDR literal uprobe support The simulateldrliteral and simulateldrswliteral functions are unsafe to use for uprobes. Both functions were originally written for use with kprobes, and access memory with...

Linux Distros Unpatched Vulnerability : CVE-2024-36915

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: fix nfcllcpsetsockopt unsafe copies syzbot reported unsafe calls to copyfromsockptr 1 Use copysafefromsockptr instead. 1 BUG: KASAN: slab-out-of-boun...

Linux Distros Unpatched Vulnerability : CVE-2024-26946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: kprobes/x86: Use copyfromkernelnofault to read from unsafe address Read from an unsafe addre...