Linux Distros Unpatched Vulnerability : CVE-2025-54567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hw/pci/pciesriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327. CVE-2025-54567 Note that Nessus relies on...

WordPress plugin YouTube Embed 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-43483

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the retrieval of hardcoded cryptographic keys. HP has addressed the issue in the latest software update...

CVE-2025-43020

A potential command injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a privileged user to submit arbitrary input. HP has addressed the issue in the latest software update...

HP Poly Clariti Manager devices 操作系统命令注入漏洞

HP Poly Clariti Manager devices is a device management system from Hewlett-Packard HP in the United States. An operating system command injection vulnerability exists in HP Poly Clariti Manager devices versions prior to 10.12.2, which originates from a privileged user being able to submit arbitra...

CVE-2025-54309

CrushFTP 10 before 10.8.5 and 11 before 11.3.423, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025...

WordPress Ultimate Video Player Plugin <= 10.1 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Anhchangmutrang in WordPress Plugin Ultimate Video Player versions = 10.1...

Malicious code in defectdojosw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 93d614c0d808786b112774fdec4eb2b8afecef6ec8de82e4945bdc644e5023c4 The OpenSSF Package Analysis project identified 'defectdojosw' @ 10.1.0 npm as malicious. It is considered malicious because: - The package...

CVE-2025-52486

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially crafted content in URLs to be used with TokenReplace and not be properly sanitized by some SkinObjects. This issue has been...

IBM Security Verify Access Docker和IBM Security Verify Access Appliance 安全漏洞

IBM Security Verify Access Docker and IBM Security Verify Access Appliance are both products of International Business Machines IBM.IBM Security Verify Access Docker is a software that can be used to configure a Docker IBM Security Verify Access Docker is a service that can be used to configure a...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.2-ifix2 Vulnerability Details CVEID:CVE-2019-12900 DESCRIPTION: BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. CWE:CWE-787: Out-of-bounds Write CVSS...

BIT-MARIADB-MIN-2022-27457

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component mymbwclatin1 at /strings/ctype-latin1.c...

BIT-MARIADB-MIN-2022-27452

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/itemcmpfunc.cc...

BIT-MARIADB-MIN-2022-27448

There is an Assertion failure in MariaDB Server v10.9 and below via 'node-pcur-relpos == BTRPCURON' at /row/row0mysql.cc...

Ivanti Workspace Control 安全漏洞

Ivanti Workspace Control is a suite of workspace control software from Ivanti USA. The software includes features such as user management, application management and report management. A security vulnerability exists in Ivanti Workspace Control versions prior to 10.19.10.0, which stems from a...

CVE-2025-5703

The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and including, 10.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-44148

Cross Site Scripting XSS vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component...

CVE-2025-48748

Netwrix Directory Manager formerly Imanami GroupID through v.10.0.7784.0 has a hard-coded password...

CVE-2025-48748

Netwrix Directory Manager formerly Imanami GroupID through v.10.0.7784.0 has a hard-coded password...

SUSE SLES15: libmariadbd-devel / libmariadbd19 / mariadb / mariadb-bench / etc (SUSE-SU-2025:01716-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01716-1 advisory. Update to version 10.11.11. - CVE-2025-21490: vulnerability allows high privileged attacker with network access to cause hang...