5187 matches found
CVE-2025-21626
GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the status.php endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the status.p...
PT-2025-9035 · Infoblox · Infoblox Nios
Name of the Vulnerable Software and Affected Versions: Infoblox NIOS versions prior to 8.6.5 Description: The issue is related to improper authentication for Grids, which could potentially allow unauthorized access. Recommendations: For versions prior to 8.6.5, update to version 8.6.5 or later to...
LibreOffice Improper Input Validation Vulnerability (Feb 2025) - Windows
LibreOffice is prone to an improper input validation vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
PT-2025-8937
Name of the Vulnerable Software and Affected Versions mongosh versions prior to 2.3.9 Description The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature can use the autocompletion feature to input and run obfuscated...
SUSE-SU-2025:0735-1 Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues: Update to version 2.46.6 bsc1236946, bsc1234851: - CVE-2025-24143: A maliciously crafted webpage may be able to fingerprint the user. - CVE-2025-24150: Copying a URL from Web Inspector may lead to command injection. - CVE-2025-24158:...
Amazon Linux 2 : docker (ALASDOCKER-2025-051)
The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2025-051 advisory. golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead ...
PT-2025-8668
Name of the Vulnerable Software and Affected Versions Simple Certain Time to Show Content WordPress plugin versions prior to 1.3.1 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputt...
PT-2025-8679 · WordPress · Wp Extra Fields
Name of the Vulnerable Software and Affected Versions: WP Extra Fields WordPress plugin version 1.0.1 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be used...
PT-2025-8672
Name of the Vulnerable Software and Affected Versions The Custom Block Builder WordPress plugin versions prior to 3.8.3 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in...
PT-2025-12: Deserialization of Untrusted Data in HTML2PDF
The vulnerability was identified in HTML2PD, version 5.3.0. The discovered vulnerability allows an attacker to create objects of arbitrary classes, fully controlling their properties, thus modify the logic of the web application. Vulnerability status: Confirmed by vendor Date of vulnerability...
Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2025-050)
The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2025-050 advisory. golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims c...
CVE-2025-27110
Libmodsecurity3 contains a vulnerability in version 3.0.13 where encoded HTML entities with leading zeroes are not decoded correctly. A fixed release is 3.0.14. Several advisories (Fedora, openSUSE/SUSE, OpenVAS/NASL entries) reference CVE-2025-27110 and mandate/update to 3.0.14 to remediate. The...
CVE-2025-25192 GLPI allows unauthorized access to debug mode
GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the install/update.php file...
CVE-2025-23024 GLPI: Plugins are disabled accessing one page
GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the install/update.php file...
WordPress Everest Forms Plugin < 3.0.8.1 - Authenticated (Admin+) XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.128103";...
openSUSE Security Advisory (SUSE-SU-2024:2813-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Stable Channel Update for Desktop
The Stable channel has been updated to 133.0.6943.141/.142 for Windows, Mac and 133.0.6943.141 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. 2025-11-20: Updated to correct the security bugs included in the release Security...
PT-2025-10638 · Google +2 · V8 +3
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 134.0.6998.88 Description: The issue involves an out of bounds read in V8, allowing a remote attacker to access memory out of bounds via a crafted HTML page. The severity of this issue is classified as Medium...
CVE-2024-9150
Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might be included. An attacker is able use a low privileges account in order to abuse this functionality and execute malicious code, load DLL libraries and executing OS commands on a...
