SUSE-SU-2025:02296-1 Security update for go1.23

This update for go1.23 fixes the following issues: - Update to version go1.23.11 - CVE-2025-4674: Fixed potential command execution in untrusted VCS repositories. bsc1246118...

Security update for rust-keylime

This update for rust-keylime fixes the following issues: CVE-2024-12224: idna: Fixed improper validation in punycode bsc1243861 Update to version 0.2.7+70: builddeps: bump wiremock from 0.6.2 to 0.6.3 builddeps: bump uuid from 1.16.0 to 1.17.0 lib: Introduce AgentIdentity structure gitignore: Add...

PT-2025-29865 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: A Reflected Cross-Site Scripting XSS vulnerability exists in the personalizacao selecao.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts through...

PT-2025-29839 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open source web manager. A Stored Cross-Site Scripting XSS vulnerability exists in the adicionar cor.php endpoint, allowing attackers to inject malicious scripts into the cor parameter...

Apache HTTP Server 2.4.26 < 2.4.64 DoS Vulnerability - Windows

Apache HTTP Server is prone to a denial of service DoS vulnerability in modproxyhttp2. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-29209 · WordPress · Geodirectory

Name of the Vulnerable Software and Affected Versions: GeoDirectory WordPress plugin versions prior to 2.8.120 Description: The GeoDirectory WordPress plugin does not validate or escape certain shortcode attributes before displaying them within a page or post. This could allow users with...

PT-2025-29195

Name of the Vulnerable Software and Affected Versions: Connect2id Nimbus JOSE + JWT versions prior to 10.0.2 Description: The software is susceptible to a denial-of-service condition triggered by a deeply nested JSON object within a JWT claim set. This occurs due to uncontrolled recursion during...

Apache HTTP Server 2.4.17 < 2.4.64 DoS Vulnerability - Linux

Apache HTTP Server is prone to a denial of service DoS vulnerability via HTTP/2. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-29867 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: An authentication bypass issue exists in the /dao/verificar recursos cargo.php API endpoint of the WeGIA application. This allows unauthenticated users to access protected functionalities and retriev...

Cockpit < 2.11.4 XSS

The version of Cockpit running on the remote web server prior to 2.11.4. A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site...

CVE-2025-2521 Lack of indexes’ validation against buffer borders leads to remote code execution.

The Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access CDA. An attacker could potentially exploit this vulnerability, leading to an Overread Buffers, which could result in improper index validation against buffer borders leading ...

CVE-2025-46835 Git GUI can create and overwrite files for which the user has write permission

Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permissio...

CVE-2025-6211 MD5 Hash Collision in run-llama/llama_index

A vulnerability in the DocugamiReader class of the run-llama/llamaindex repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk...

CVE-2025-6211

CVE-2025-6211 affects the DocugamiReader class in the run-llama/llama_index project (up to v0.12.28). It uses MD5 to generate IDs for document chunks, which can collide when chunks have identical text but different structure, causing one chunk to overwrite another and potentially losing semantica...

BIT-GIT-2025-48386 Git allows a buffer overflow in 'wincred' credential helper

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer target as a unique key for storing and comparing against internal storage. This...

PT-2025-29155 · Unknown · Callmanager

Name of the Vulnerable Software and Affected Versions: Chall-Manager versions prior to 0.1.4 Description: Chall-Manager, a platform-agnostic system for starting Challenges on Demand, is susceptible to a Denial of Service DoS attack via a slow loris attack against its HTTP Gateway. The gateway lac...

PT-2025-29139 · Unknown · Processmaker

Name of the Vulnerable Software and Affected Versions: ProcessMaker versions prior to 3.5.4 Description: An unrestricted file upload vulnerability exists due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file...

PT-2025-29085

Name of the Vulnerable Software and Affected Versions: LibHTP versions 0.5.50 and below Description: LibHTP is a security-aware parser for the HTTP protocol. Versions 0.5.50 and below contain a traffic-induced memory leak that can lead to process memory starvation and loss of visibility...

PT-2025-29121 · Mediawiki · Dynamicpagelist3

Name of the Vulnerable Software and Affected Versions: DynamicPageList3 extension versions prior to 3.6.4 Description: The DynamicPageList3 extension for MediaWiki contains an issue where certain parameters can reveal usernames that have been hidden through revision deletion, suppression, or the...

PT-2025-29132 · Unknown · Matrix-Sdk

Name of the Vulnerable Software and Affected Versions: matrix-sdk versions 0.11 through 0.12 Description: An SQL injection vulnerability exists in the EventCache::find event with relations method. This allows malicious room members to execute arbitrary SQL commands in Matrix clients that directly...