openSUSE: Security Advisory for buildah (SUSE-SU-2025:0319-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-24901

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, deletarpermissao.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information...

CVE-2025-23210

CVE-2025-23210 affects the PHPSpreadsheet library. Affected versions allow bypassing the XSS sanitizer when processing XML input, enabling execution of attacker-controlled JavaScript in the browser upon rendering HTML. The issue is fixed in PhpSpreadsheet versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9;...

Security update for docker

This update for docker fixes the following issues: Security fixes: CVE-2024-23651: Fixed arbitrary files write due to race condition on mounts bsc1219267 CVE-2024-23652: Fixed insufficient validation of parent directory on mount bsc1219268 CVE-2024-23653: Fixed insufficient validation on...

CVE-2025-0377

An archive extraction vulnerability was found in HashiCorp's go-slug library. When go-slug performs an extraction, the filename/extraction path is taken from the tar entry via the header.Name. It was discovered that the unpacking step improperly validated paths, potentially leading to path...

SUSE SLES15 / openSUSE 15 Security Update : google-osconfig-agent (SUSE-SU-2025:0302-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:0302-1 advisory. - Update to version 20250115.01 bsc1236406, bsc1236407 - CVE-2024-24790: Bump the golang compiler version to 1.22.4 bsc1225974...

SUSE-SU-2025:0320-1 Security update for buildah

This update for buildah fixes the following issues: - Update to version 1.35.5 - CVE-2024-11218: Fix TOCTOU error when bind and cache mounts use 'src' values. bsc1236272...

PT-2025-1998

Name of the Vulnerable Software and Affected Versions Widget4Call WordPress plugin versions 1.0.0 through 1.0.7 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

PT-2025-3903 · WordPress · The Forminator Forms

Name of the Vulnerable Software and Affected Versions: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to, and including, 1.38.2 Description: The issue is related to Reflected Cross-Site Scripting via the title parameter due to insufficient...

CVE-2025-23216

Technical details about CVE-2025-23216 are not publicly available in the provided documents; no affected versions, root cause, or remediation are specified beyond the fixed versions. Monitor for updates.

SUSE-SU-2025:0297-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z. Refs jscPED-11136 Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx GO-2025-3410 CVE-2025-24337...

PT-2025-2256 · WordPress · Wp Image Uploader

Name of the Vulnerable Software and Affected Versions: WP Image Uploader plugin for WordPress version 1.0.1 and earlier Description: The issue is related to insufficient file path validation in the gky image uploader main function function, allowing unauthenticated attackers to delete arbitrary...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : MySQL vulnerabilities (USN-7245-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7245-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issue...

GHSA-2MQW-RQ5M-8HC8 Snowflake.Data has weak temporary files permissions

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine. This vulnerability affects versions...

CVE-2025-24793 Snowflake Connector for Python has an SQL Injection in write_pandas

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the...

CVE-2025-24884

The CVE-2025-24884 entry concerns kube-audit-rest, a simple logger for Kubernetes API mutations. When the here-described full-elastic-stack example vector is used, previous values of Kubernetes secrets could be disclosed in audit messages due to the logger capturing sensitive data. Fixed in versi...

SUSE-SU-2025:0291-1 Security update for iperf

This update for iperf fixes the following issues: - Update to version 3.18 - CVE-2024-53580: Fixed a segmentation violation via the iperfexchangeparameters function. bsc1234705...

CVE-2025-24792 Snowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Error

Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects PDO extension to connect to the Snowflake database. Snowflake discovered and remediated a vulnerability in the Snowflake PHP PDO Driver where executing unsupported queries like PUT or GET on stages causes a signed-to-unsigned...

Fedora 40 : dotnet8.0 (2025-16778d3c88)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-16778d3c88 advisory. This is the January 2025 security and bugfix release for .NET 8.0. It updates the SDK to version 8.0.112 and Runtime to version 8.0.12. Release Note...

Security Bulletin: IBM Security SOAR is using components with multiple known vulnerabilities (CVE-2024-47764)

Summary IBM Security SOAR uses an older version of the jshttp cookie UI component that may be identified and exploited. An update has been released which addresses these issues. It is recommended that customers upgrade to Version 51.0.4.1 or later of IBM Security SOAR. Vulnerability Details...