Fedora: Security Advisory (FEDORA-2025-e41ba62ff1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2025-59538

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoi...

CVE-2025-60782

PHP Education Manager v1.0 is vulnerable to Cross Site Scripting XSS stored Cross-Site Scripting XSS vulnerability in the topics management module topics.php. Attackers can inject malicious JavaScript payloads into the Titlefield during topic creation or updates...

CVE-2025-60782

PHP Education Manager v1.0 is vulnerable to Cross Site Scripting XSS stored Cross-Site Scripting XSS vulnerability in the topics management module topics.php. Attackers can inject malicious JavaScript payloads into the Titlefield during topic creation or updates...

CVE-2025-60782

PHP Education Manager v1.0 is vulnerable to Cross Site Scripting XSS stored Cross-Site Scripting XSS vulnerability in the topics management module topics.php. Attackers can inject malicious JavaScript payloads into the Titlefield during topic creation or updates...

Fedora 43 : freeipa (2025-54a485ee85)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-54a485ee85 advisory. - CVE-2025-7493: host to admin escalation prevention: https://www.freeipa.org/release-notes/4-12-5.html - Rebuild for Python 3.14.0rc3 - Update FreeIPA to...

CVE-2025-60782

PHP Education Manager v1.0 is vulnerable to Cross Site Scripting XSS stored Cross-Site Scripting XSS vulnerability in the topics management module topics.php. Attackers can inject malicious JavaScript payloads into the Titlefield during topic creation or updates...

CVE-2025-59538

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoi...

CVE-2025-59538 Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoi...

Cisco Unified Communications Manager Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of...

Cisco Cyber Vision Center Stored Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Cyber Vision Center could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. These vulnerabilities exist because the web-based management interface of an...

CVE-2022-50436

In the Linux kernel, the following vulnerability has been resolved: ext4: don't set up encryption key during jbd2 transaction Commit a80f7fcf1867 "ext4: fixup ext4fctrack functions' signature" extended the scope of the transaction in ext4unlink too far, making it include the call to ext4findentry...

PT-2025-40308

Name of the Vulnerable Software and Affected Versions risc0-zkvm-platform versions 2.0.2 and below risc0-aggregation versions below 0.9 risc0-zkos-v1compat versions below 2.1.0 risc0-zkvm versions 3.0.0-rc.1 through 3.0.1 Description The software contains a flaw related to memory safety in the sy...

PT-2025-40210

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the ext4 filesystem implementation. Specifically, the ext4 get group info function previously triggered a kernel BUG when encountering an invalid...

idm:DL1 security update

bind-dyndb-ldap 11.6-6 - Fix rpminspect warnings Resolves: RHEL-22497 custodia ipa 4.9.13-20.0.1 - Set IPAPLATFORM=rhel when build on Oracle Linux Orabug: 29516674 4.9.13-20 - Refactor ipatests for unique krbcanonicalname Resolves: RHEL-110061 4.9.13-19 - Enforce uniqueness across krbprincipalnam...

Improper Check or Handling of Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions in the /api/webhook endpoint. An attacker can cause the server process to crash by sending an Azure DevOps Push event with an empty resource.refUpdates array. Note: This is only...

CVE-2025-56513

NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An attacker capable of intercepting or redirecting traffic to the update url and can hijack the update process and deliver arbitrary executables that are automatically executed,...

CVE-2025-56301

An issue was discovered in Chipsalliance Rocket-Chip commit f517abbf41abb65cea37421d3559f9739efd00a9 2025-01-29 allowing attackers to corrupt exception handling and privilege state transitions via a flawed interaction between exception handling and MRET return mechanisms in the CSR logic when an...

Apple fixes critical font processing bug. Update now!

Apple has released important security updates to address a critical vulnerability in FontParser —the part of MacOS/iOS/iPadOS that processes fonts. Identified as CVE-2025-43400, the flaw was discovered internally by Apple and allows an attacker to craft a malicious font that can cause apps to cra...

Vulnerabilities fixed in VMware NSX

VMware fixed vulnerabilities in VMware NSX The vulnerabilities in VMware NSX include a weak password recovery mechanism that allows unauthenticated attackers to enumerate valid usernames, which can result in potential brute-force attacks on login credentials. Additionally, there is a username...