openSUSE 16 Security Update : git-bug (openSUSE-SU-2025-20143-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20143-1 advisory. Changes in git-bug: - Revendor to include fixed version of depending libraries: - GO-2025-4116 CVE-2025-47913, bsc1253506 upgrade...

Users with read-only permissions for team folder can restore deleted files from trash bin

None...

Calendar app allowed booking appointments without the generated token

None...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses transformers-4.51.3-py3-none-any.whl which is vulnerable to CVE-2025-6921.

Summary IBM Maximo Application Suite - Monitor Component uses transformers-4.51.3-py3-none-any.whl which is vulnerable to CVE-2025-6921. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2025-6921 DESCRIPTION: The huggingface/transformers library,...

Apache Struts 2.0.0 <= 6.7.0 / 7.0.0 <= 7.0.3 Denial of Service (S2-068)

The version of Apache Struts installed on the remote host is 2.0.0 through 6.7.0 or 7.0.0 through 7.0.3. It is, therefore, affected by a denial of service vulnerability as referenced in the S2-068 advisory: - Denial of Service vulnerability in Apache Struts, file leak in multipart request...

CVE-2025-20386 Incorrect permission assignment on Splunk Enterprise for Windows during new installation or upgrade

In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Splunk Enterprise for Windows Installation directory. This lets non-administrator users on the machine...

Debian dsa-6064 : tryton-server - security update

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6064 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6064-1 [email protected] https://www.debian.org/security/...

Security Bulletin: Vulnerabilities in Spring Context affect IBM SPSS Collaboration and Deployment Services (CVE-2025-22233, CVE-2024-38820)

Summary Vulnerabilities in Spring Context affect IBM SPSS Collaboration and Deployment Services CVE-2025-22233, CVE-2024-38820. These have been addressed in the remediation section. Vulnerability Details CVEID:CVE-2025-22233 DESCRIPTION: CVE-2024-38820 ensured Locale-independent, lowercase...

Fedora: Security Advisory (FEDORA-2025-1ccd7dbf40)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 6064-1] tryton-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6064-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 27, 2025 https://www.debian.org/security/faq -...

Contao is vulnerable to remote code execution in template closures

Impact Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. Patches Update to Contao 4.13.57, 5.3.42 or 5.6.5 Workarounds Manually patch the Contao\Template::once method. Resources...

webkit2gtk3 security update

2.50.1-1 - Update to 2.50.1 2.50.0-1 - Update to 2.50.0 2.48.5-1 - Update to 2.48.5 2.48.3-1 - Update to 2.48.3 2.48.2-1 - Update to 2.48.2 - Reenable JIT 2.48.1-1 - Update to 2.48.1 2.48.0-1 - Update to 2.48.0 2.46.6-1 - Update to 2.46.6 2.46.5-1 - Update to 2.46.5 2.46.4-1 - Update to 2.46.4...

PT-2025-47897

A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command, due to inadequate filtering of the driver's parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has...

PT-2025-47898

A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execute a malicious command. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user...

PT-2025-47896

An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supplied script. Exploitation required at least one Looker extension installed on the instance. Looker-hosted and Self-hosted were found to be vulnerable. This...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Information Disclosure (CVE-2025-36134)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the information disclosure vulnerability. Please apply the following upgrades to remediate the vulnerability. Vulnerability Details CVEID:CVE-2025-36134 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File...

Vulnerability fixed in Fortinet FortiWeb

Fortinet has fixed a vulnerability in FortiWeb. The vulnerability is in the way Fortinet FortiWeb handles HTTP requests and CLI commands. Authenticated attackers can exploit this vulnerability to execute unauthorized code via carefully crafted HTTP requests or CLI commands. Fortinet has confirmed...

PT-2025-47449

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for...

Deserialization of Untrusted Data

Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via improper handling of dynamically-determined object attributes. An attacker who has...

CVE-2025-64329

A flaw was found in containerd. This vulnerability allows a user to exhaust memory on the host due to goroutine leaks via a bug in the CRI Container Runtime Interface Attach implementation...