CVE-2025-5690

PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pgdump. This problem occurs only when dynamic masking is enabled, which is not the...

CVE-2025-5690

The CVE-2025-5690 entry concerns PostgreSQL Anonymizer (versions 2.0 and 2.1). Affected component: the masking mechanism when dynamic masking is enabled, which allows a masked user to bypass table masking rules and read original data via a database cursor or the --insert option in pg_dump. This i...

CVE-2025-5690 Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data

PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pgdump. This problem occurs only when dynamic masking is enabled, which is not the...

CVE-2025-48935 Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using ATTACH DATABASE statement. Version 2.2.5 contains a patch for the issue...

BIT-MODSECURITY-2025-48866 ModSecurity has possible DoS vulnerability in sanitiseArg action

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg and sanitizeArg - this is the same action but an alias is...

PT-2025-23732 · Unknown · Billboard.Js

Name of the Vulnerable Software and Affected Versions: billboard.js versions prior to 3.15.1 Description: The issue is related to a prototype pollution via the generate function, which could allow attackers to execute arbitrary code or cause a Denial of Service DoS by injecting arbitrary...

PT-2025-23799 · Oscommerce · Oscommerce

Name of the Vulnerable Software and Affected Versions: osCommerce version 4 Description: The issue is a Reflected Cross-Site Scripting XSS that allows an attacker to execute JavaScript code in the victim's browser. This can be achieved by sending a malicious URL using any parameter name in the...

Slackware Linux 15.0 / current python3 Multiple Vulnerabilities (SSA:2025-155-02)

The version of python3 installed on the remote host is prior to 3.12.11 / 3.9.23. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-155-02 advisory. New python3 packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted...

Oracle Linux 9 : nodejs:20 (ELSA-2025-8468)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8468 advisory. nodejs 1:20.19.2-1 - Update to version 20.19.2 Resolves: RHEL-92865 RHEL-88876 RHEL-91597 nodejs-nodemon nodejs-packaging Tenable has extracted the preceding...

PT-2025-23795 · Unknown · Airleader Master

Name of the Vulnerable Software and Affected Versions: airleader MASTER version 3.0046 Description: The issue allows retrieval of embedded sensitive data due to a Path Traversal vulnerability. This vulnerability enables access to sensitive information embedded within the system. Recommendations:...

CVE-2025-49000

InvenTree (before v0.17.13) has an unbounded skip field in the built-in label-sheet plugin. An authenticated label-printing user can trigger a denial-of-service via memory exhaustion by supplying a large value, as described in CVE-2025-49000. The issue is fixed in v0.17.13 and higher. No workarou...

BIT-DRUPAL-2025-31673 Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

Security update for 389-ds

This update for 389-ds fixes the following issues: Security fixes: CVE-2025-3416: Fixed use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate bsc1242666 Other fixes: Enable memory accounting as SUSE disables it by default bsc1241016. Fix dsidm service getdn option failing bsc1241988...

PT-2025-23624 · Unknown · Pekko Management

Name of the Vulnerable Software and Affected Versions: Pekko Management versions prior to 1.1.1 Description: The issue arises when Basic Authentication is enabled in Pekko Management using the Java DSL, potentially causing the authenticator to not be properly applied. This could affect users who...

PT-2025-23587 · WordPress · Fancybox

Name of the Vulnerable Software and Affected Versions: FancyBox for WordPress versions prior to 3.3.6 Description: The issue is related to the FancyBox plugin for WordPress not escaping captions and titles attributes before using them to populate galleries' caption fields. This was initially...

PT-2025-23599

Name of the Vulnerable Software and Affected Versions Parallels Desktop for Mac version 20.2.2 Description A directory traversal vulnerability exists in the PVMP package unpacking functionality. This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to...

PT-2025-23586 · WordPress · The Newsletter

Name of the Vulnerable Software and Affected Versions: The Newsletter WordPress plugin versions prior to 8.8.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, i...

PT-2025-23589

Name of the Vulnerable Software and Affected Versions Post Slider and Post Carousel with Post Vertical Scrolling Widget versions prior to 3.2.10 Description The issue concerns the WordPress plugin Post Slider and Post Carousel with Post Vertical Scrolling Widget, where certain widget options are...

PT-2025-23567 · WordPress · The Golo - City Travel Guide Wordpress Theme

Name of the Vulnerable Software and Affected Versions: The Golo - City Travel Guide WordPress Theme version 1.7.0 and earlier Description: The issue is related to privilege escalation via account takeover due to the plugin not properly validating a user's identity prior to setting an authorizatio...

CVE-2025-48866

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg and sanitizeArg - this is the same action but an alias is...