SUSE-SU-2025:01748-2 Security update for postgresql15

This update for postgresql15 fixes the following issues: Upgrade to 15.13: - CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation bsc1242931 Changelog: https://www.postgresql.org/docs/release/15.13/...

CVE-2025-5996

An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input validation in HTTP responses could allow an authenticated user to cause denial of service...

CVE-2025-1516

An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper input validation in Tokens Names could be used to trigger a denial of service...

CVE-2025-1478

CVE-2025-1478 affects GitLab CE/EE. The issue is a lack of input validation in Board Names, which can be exploited to trigger a denial of service. Affected versions are: 8.13–17.10.6, 17.11–17.11.2, and 18.0–18.0.0. Remediation (fixed in): GitLab 17.10.7+, 17.11.3+, and 18.0.1+. No exploitation d...

CVE-2025-5996 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input validation in HTTP responses could allow an authenticated user to cause denial of service...

CVE-2025-5996

CVE-2025-5996 describes a denial-of-service issue in GitLab CE/EE across multiple versions (2.1.0–17.10.7, 17.11.0–17.11.3, 18.0.0–18.0.1) caused by insufficient input validation in HTTP responses. An authenticated user can trigger DoS, with CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (base sco...

CVE-2025-5925

The Bunny’s Print CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.95. This is due to missing or incorrect nonce validation on the pcssoptionssubpanel function. This makes it possible for unauthenticated attackers to update settings via ...

AVEVA PI Connector for CygNet 安全漏洞

AVEVA PI Connector for CygNet is a tool from AVEVA UK that provides unidirectional data transfer from a CygNet SCADA system to a PI system. A security vulnerability exists in AVEVA PI Connector for CygNet version 1.6.14 and earlier, which stems from improper validation of integrity check values a...

CVE-2024-55567

Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before 05.71.01. The SMM module has an SMM call out vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary...

GitLab 8.13 < 17.10.8 / 17.11 < 17.11.4 / 18.0 < 18.0.2 (CVE-2025-1478)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in Board Names could be used to...

GO-2025-3754 CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl

CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl...

PT-2025-25286 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.13 through 17.10.7 GitLab CE/EE versions 17.11 through 17.11.3 GitLab CE/EE versions 18.0 through 18.0.1 Description: An issue has been discovered in GitLab CE/EE, where a lack of input validation in Board Names could ...

FreeFloat FTP Server Buffer Overflow Vulnerability (CNVD-2025-14374)

FreeFloat FTP Server is an FTP service from FreeFloat. A buffer overflow vulnerability exists in FreeFloat FTP Server, which stems from the component SET Command Handler failing to properly validate the length size of input data, no details of the vulnerability are provided at this time...

CVE-2025-0052

Pure Storage FlashBlade has a CVE-2025-0052 vulnerability: improper input validation during authentication that could cause a Denial of Service. Affected component is the authentication path; impact is high for availability. No concrete exploit details or fix/version information are provided in t...

CVE-2025-0051

CVE-2025-0051 describes an issue in Pure Storage FlashArray where improper input validation during authentication can cause a Denial of Service. The connected documents identify the affected product (FlashArray) and the root cause (input validation during authentication) with the impact being DoS...

CVE-2025-0051 FlashArray DOS Vulnerability

Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service...

CVE-2025-24471

An Improper Certificate Validation vulnerability CWE-295 in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate...

CVE-2024-34711 GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities XEE attack, then send GET request to any HTTP server. By default, GeoServer use...

Microsoft Outlook Remote Code Execution Vulnerability

Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally...

CVE-2025-4954 Axle Demo Importer <= 1.0.3 - Author+ Arbitrary File Upload

The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users author and above to upload arbitrary files such as PHP on the server...