WordPress SureTriggers Plugin < 1.0.83 Privilege Escalation Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:suretriggers:suretriggers"; if description...

RHEL 8 / 9 : updated discovery-cli RPMs (Important) (RHSA-2025:7630)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7630 advisory. New version of Discovery CLI dsc and installer are now available for RHEL 8 and RHEL 9 for Discovery 1.14. Tenable has extracted the preceding...

PT-2025-21485 · WordPress · The Kbucket: Your Curated Content

Name of the Vulnerable Software and Affected Versions: The KBucket: Your Curated Content in WordPress plugin versions prior to 4.1.6 Description: The issue concerns the lack of sanitization and escaping of certain settings in the plugin, which could allow high-privilege users, such as admins, to...

Security Bulletin: Vulnerability in Netty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Netty has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

CLSA-2025-1747251120 buildah: Fix of 2 CVEs

Rebuild with new golang version to address the following CVEs: - CVE-2023-45287: Timing Side Channel attack in RSA based TLS key exchanges - CVE-2024-34156: panic due to stack exhaustion for Decoder.Decode...

[SECURITY] [DLA 4165-1] open-vm-tools security update

Debian LTS Advisory DLA-4165-1 [email protected] https://www.debian.org/lts/security/ Jochen Sprickerhof May 14, 2025 https://wiki.debian.org/LTS Package : open-vm-tools Version : 2:11.2.5-2+deb11u4 CVE ID : CVE-2025-22247 Debian Bug : 1105159 open-vm-tools is a package that provides Op...

CVE-2025-47775 Bullfrog's DNS over TCP bypasses domain filtering

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue...

CVE-2025-24026

iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service ReDoS that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop...

CVE-2024-56157

iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before...

CVE-2025-24785 iTop dashboard vulnerable to denial of service

iTop is an web based IT Service Management tool. In version 3.2.0, an attacker may send a URL to the server to trigger a PHP error. The next user trying to load this dashboard would encounter a crashed start page. Version 3.2.1 fixes the issue by checking the provided layoutclass before saving th...

CVE-2025-24026 iTop Inefficient Regular Expression Complexity vulnerability

iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service ReDoS that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop...

PT-2025-21166 · Opentext · Opentext Advance Authentication

Name of the Vulnerable Software and Affected Versions: OpenText Advance Authentication versions prior to 6.5 Description: The issue is related to an SQL Injection vulnerability due to the improper neutralization of special elements used in an SQL command. This allows for potential exploitation by...

PT-2025-21236 · Pichome · Pichome

Name of the Vulnerable Software and Affected Versions: Pichome system versions prior to 2.1.0 Description: A Cross-Site Scripting XSS issue was found due to insufficient sanitization of user input in the login form. This allows an attacker to inject malicious JavaScript code into the username or...

PT-2025-21251 · Unknown · Label Studio

Name of the Vulnerable Software and Affected Versions: Label Studio versions prior to 1.18.0 Description: A vulnerability in Label Studio allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf...

PT-2025-21249 · Intel · Intel Gaudi

Name of the Vulnerable Software and Affected Versions: IntelR GaudiR software versions prior to 1.18 Description: The issue is related to incorrect default permissions in some IntelR GaudiR software installers, which may allow an authenticated user to potentially enable escalation of privilege vi...

PT-2025-21193

Name of the Vulnerable Software and Affected Versions: Drupal IFrame Remove Filter versions 0.0.0 through 2.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to perform Cross-Site...

PT-2025-21194 · Drupal · Enterprise Mfa - Tfa For Drupal

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x Description: The issue is related to an Authentication Bypass by Capture-replay vulnerability in Enterprise MFA - TFA fo...

PT-2025-21172 · Itop · Itop

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 3.2.1 Description: The issue is related to a regular expression denial of service ReDoS that may affect the iTop server under certain circumstances. The problem arises from the use of an affected variable in a regular...

PT-2025-21190 · Unknown · Oembed Providers

Name of the Vulnerable Software and Affected Versions: oEmbed Providers versions 0.0.0 through 2.2.1 Description: The issue affects oEmbed Providers, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. Recommendations: For versions 0.0.0 through...

PT-2025-21223

Name of the Vulnerable Software and Affected Versions: PointCloudLibrary PCL versions prior to 1.14.0 Description: A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary PCL. This issue may allow context-dependent attackers to cause...