SUSE-SU-2025:01767-1 Security update for postgresql16

This update for postgresql16 fixes the following issues: Upgrade to 16.9: - CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation bsc1242931 Changelog: https://www.postgresql.org/docs/release/16.9/...

Security update for postgresql17

This update for postgresql17 fixes the following issues: Upgrade to 17.5: CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation bsc1242931 Changelog: https://www.postgresql.org/docs/release/17.5/ Patch Instructions: To...

PT-2025-23275

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 4.1.2 Description An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into sqlExpression fields. This allowed the execution of...

PT-2025-23335 · Go-Gh +1 · Go-Gh +1

Name of the Vulnerable Software and Affected Versions: go-gh versions prior to 2.12.1 Description: A security issue has been identified where an attacker-controlled GitHub Enterprise Server could execute arbitrary commands on a user's machine. This is achieved by replacing HTTP URLs provided by...

CVE-2025-46701

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1...

CVE-2025-46701 Apache Tomcat: Security constraint bypass for CGI scripts

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1...

SUSE-SU-2025:01551-1 Security update for go1.24

This update for go1.24 fixes the following issues: Update to go1.24.3 bsc1236217: Security fixes: - CVE-2025-22873: Fixed os.Root permits access to parent directory bsc1242715 Changelog: go73556 go73555 security: fix CVE-2025-22873 os: Root permits access to parent directory go73082 os: Root.Open...

Apache Tomcat 10.1.0.M1 < 10.1.41

The version of Tomcat installed on the remote host is prior to 10.1.41. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.1.41security-10 advisory. - Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constrain...

Apache Tomcat 11.0.0.M1 < 11.0.7

The version of Tomcat installed on the remote host is prior to 11.0.7. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat11.0.7security-11 advisory. - Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint...

Debian dsa-5929 : chromium - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5929 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5929-1 [email protected] https://www.debian.org/securit...

Debian dla-4189 : python-webpy-doc - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4189 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4189-1 [email protected] https://www.debian.org/lts/security/...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the page preview functionality. An attacker can access unpublished content and potentially expose sensitive information by exploiting predictable URLs without proper authorization...

Apache Commons Improper Access Control vulnerability

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default...

GHSA-WXR5-93PH-8WR9 Apache Commons Improper Access Control vulnerability

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default...

CVE-2025-48734

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default...

CVE-2025-5183

A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as problematic. This issue affects some unknown processing of the component Header Handler. The manipulation of the argument Host leads to open redirect. The attack may be initiated...

Command Injection

Overview llama-index-cli is a llama-index cli Affected versions of this package are vulnerable to Command Injection through the CLI interface due to pasting the --files argument directly into os.system. An attacker who controls the content of this argument can execute arbitrary commands on the...

Apache InLong: JDBC Vulnerability during verification processing

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick 1 to solve it. 1...

CVE-2025-27526

CVE-2025-27526 affects Apache InLong versions 1.13.0 through 2.1.0 and is due to insecure deserialization of untrusted data, which can enable a JDBC URL-encoding/backspace bypass vulnerability. The issue’s remediation is to upgrade to InLong 2.2.0 or cherry-pick the confirmed fix from GitHub (PR ...

CVE-2025-27522 Apache InLong: JDBC Vulnerability during verification processing

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick 1 to solve it. 1...