PT-2025-2136 · WordPress · Youzify

Name of the Vulnerable Software and Affected Versions: Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions up to, and including, 1.3.2 Description: The issue is related to unauthorized access due to a missing capability check on the youzify offe...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in express-4.19.2.tgz

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of express-4.19.2.tgz Vulnerability Details CVEID:CVE-2024-43796 DESCRIPTION: expressjs express is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker coul...

Important: tomcat

Issue Overview: Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write non-default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through...

PT-2025-5392 · Icegram · Icegram

Name of the Vulnerable Software and Affected Versions: Icegram versions through 3.1.31 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions through...

PT-2025-5396 · Unknown · Rstheme Ultimate Coming Soon & Maintenance

Name of the Vulnerable Software and Affected Versions: RSTheme Ultimate Coming Soon & Maintenance versions 1.0.0 through 1.0.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 1.0.0 through 1.0.9,...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of http-proxy-middleware Vulnerability Details CVEID:CVE-2024-21536 DESCRIPTION: http-proxy-middleware is vulnerable to a denial of service, caused by an UnhandledPromiseRejection error thrown by micromatch. By...

Qt: Buffer Overflow

Background Qt is a cross-platform application development framework. Description When given specifically crafted data then QXmlStreamReader can end up causing a buffer overflow and subsequently a crash or freeze or get out of memory on recursive entity expansion, with DTD tokens in XML body. Impa...

PT-2025-4933 · WordPress · Wp Social Broadcast

Name of the Vulnerable Software and Affected Versions: WP Social Broadcast versions n/a through 1.0.0 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means that an attacker can inject malicious...

Google Chrome < 132.0.6834.110 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 132.0.6834.110. It is, therefore, affected by multiple vulnerabilities as referenced in the 202501stable-channel-update-for-desktop22 advisory. - Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.110...

PT-2025-2283 · Oracle · Jd Edwards Enterpriseone Tools

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Tools versions prior to 9.2.9.0 Description: The issue is related to a component of the JD Edwards EnterpriseOne Tools system, specifically the Business Logic Infra SEC, which has a flaw in its data source confirmatio...

XSS when checking tables

PMASA-2025-1 Announcement-ID: PMASA-2025-1 Date: 2025-01-20 Updated: 2025-01-23 Summary XSS when checking tables Description An XSS vulnerability has been discovered with the phpMyAdmin "Check tables" feature. A specially–crafted table or database name could be used to trigger an XSS attack...

SUSE CVE-2024-45811

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it...

PT-2025-2148 · WordPress · Micropayments – Fans Paysite

Name of the Vulnerable Software and Affected Versions: MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress versions up to, and including, 2.9.29 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'videowhisper...

CVE-2025-21606

CVE-2025-21606 affects the macOS Stats application. The vulnerable component is the Mach service eu.exelban.Stats.SMC.Helper, exposed via XPC. The root cause is shouldAcceptNewConnection unconditionally returning YES, allowing any XPC client to connect and invoke privileged methods on the HelperT...

Zoom Workplace Desktop App < 6.2.5 Escalation of Privilege (ZSB-25004)

The version of Zoom Workplace Desktop App installed on the remote host is prior to 6.2.5. It is, therefore, affected by a vulnerability as referenced in the ZSB-25004 advisory. - Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduc...

Zoom Workplace Desktop App < 6.2.10 DoS (ZSB-25005)

The version of Zoom Workplace Desktop App installed on the remote host is prior to 6.2.10. It is, therefore, affected by a vulnerability as referenced in the ZSB-25005 advisory. - Symlink following in the installer for Zoom Workplace app for macOS before 6.2.10 may allow an authenticated user to...

PT-2025-1873 · WordPress · Glofox Shortcodes

Name of the Vulnerable Software and Affected Versions: Glofox Shortcodes plugin for WordPress versions up to, and including, 2.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'glofox' and 'glofox lead capture' shortcodes due to insufficient input sanitization a...

CVE-2025-23199 Stored XSS-LibreNMS-Ports in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: /ajaxform.php - param: descr. Librenms version up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page...

CVE-2025-23200 Stored XSS-LibreNMS-Misc Section in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: ajaxform.php - param: state. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page...

CVE-2025-23200 Stored XSS-LibreNMS-Misc Section in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: ajaxform.php - param: state. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page...