Fedora 42 : gum (2025-ddcd03b103)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ddcd03b103 advisory. Update to version 0.16.1 for various bugfixes. This also fixes CVE-2025-22872 in the bundled golang.org/x/net/html. Tenable has extracted the preceding...

CVE-2025-52995

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.10, the implementation of the allowlist is erroneous, allowing a user to execute more shell commands than they are authorized fo...

[SECURITY] [DLA 4235-1] sudo security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4235-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz June 30, 2025 https://wiki.debian.org/LTS -...

SUSE-SU-2025:02166-1 Security update for himmelblau

This update for himmelblau fixes the following issues: - CVE-2025-5791: Fixed using deprecated users crate bsc1244202 - CVE-2025-3416: Fixed use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate bsc1242648 Update to version 0.7.17+git.0.1ebdab0 Update sccache-action version to use n...

PT-2025-27449 · Unknown · Devinim Software Library

Name of the Vulnerable Software and Affected Versions: Devinim Software Library Software versions prior to 24.11.02 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks...

Slackware Linux 15.0 / current sudo Multiple Vulnerabilities (SSA:2025-181-01)

The version of sudo installed on the remote host is prior to 1.9.17p1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-181-01 advisory. New sudo packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...

PT-2025-27470 · Dell · Openmanage Network Integration

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Network Integration versions prior to 3.8 Description: The issue is related to an Authentication Bypass by Capture-replay vulnerability in the RADIUS protocol. An attacker with local network access could potentially exploit th...

PT-2025-27472 · Unknown · Filebrowser

Name of the Vulnerable Software and Affected Versions: File Browser versions prior to 2.33.9 Description: The issue concerns the leakage of JSON Web Tokens JWT used as session identifiers due to their inclusion as GET parameters in URLs. This leakage can occur when a user accesses certain URLs,...

PT-2025-27497 · Graylog · Graylog

Name of the Vulnerable Software and Affected Versions: Graylog versions prior to 6.2.4 Graylog versions prior to 6.3.0-rc.2 Description: A flaw in Graylog allows authenticated users to escalate privileges via API token abuse. This issue can be exploited by creating and using API tokens for the...

PT-2025-28010

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions prior to 3.6.4 Description: The issue is related to a race condition in AESNI detection that can occur under certain compiler optimizations. This could potentially allow an attacker to extract an AES key from a multithreaded...

SUSE SLES12: libsqlite3-0 / libsqlite3-0-32bit / sqlite3 / sqlite3-devel / etc (SUSE-SU-2025:01455-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01455-1 advisory. - CVE-2025-3277,CVE-2025-29087: Fixed integer overflow in sqlite concat function bsc1241020 - CVE-2025-29088: Fixed integer overflow through t...

CVE-2025-53091

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the /controle/getProdutosPorAlmox.php endpoint. This issue allows any unauthenticated...

SUSE-SU-2025:01455-1 Security update for sqlite3

This update for sqlite3 fixes the following issues: - CVE-2025-3277,CVE-2025-29087: Fixed integer overflow in sqlite concat function bsc1241020 - CVE-2025-29088: Fixed integer overflow through the SQLITEDBCONFIGLOOKASIDE component bsc1241078 Other fixes: - Updated to version 3.49.1 from Factory...

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: Update to version 20250416.02 bsc1244304, bsc1244503 defaultSleeper: tolerate 10% difference to reduce test flakiness Add output of some packagemanagers to the testdata from version 20250416.01 Refactor OS Info package from version...

SUSE-SU-2025:02149-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: - Update to version 20250416.02 bsc1244304, bsc1244503 defaultSleeper: tolerate 10% difference to reduce test flakiness Add output of some packagemanagers to the testdata - from version 20250416.01 Refactor OS Info package - from...

PT-2025-27226 · Re.Place · Re.Place

Name of the Vulnerable Software and Affected Versions: re.place versions 0.2.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web application, potential...

PT-2025-27206 · Unknown · Gopi Plus Image Slider With Description

Name of the Vulnerable Software and Affected Versions: gopi plus Image Slider With Description versions n/a through 9.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions n/a through 9.2, update to a version that include...

PT-2025-27103 · Sneeit · Sneeit Magone

Name of the Vulnerable Software and Affected Versions: Sneeit MagOne versions through 8.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inject...

PT-2025-27164 · Unknown · Gmedia Photo Gallery

Name of the Vulnerable Software and Affected Versions: Gmedia Photo Gallery versions 1.23.0 and earlier Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion'. This allows PHP Local File Inclusion...

PT-2025-27072 · WordPress · Ninja Forms

Name of the Vulnerable Software and Affected Versions: Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress versions up to, and including, 3.10.2.1 Description: The issue is related to Stored Cross-Site Scripting via the use of a templating engine due to insufficient...