CVE-2025-41443 Guest user can discover active public channels

Mattermost versions 10.5.x = 10.5.12, 10.11.x = 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the /api/v4/teams/teamid/channels/ids endpoint...

CVE-2025-41443 Guest user can discover active public channels

Mattermost versions 10.5.x = 10.5.12, 10.11.x = 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the /api/v4/teams/teamid/channels/ids endpoint...

Security Bulletin: IBM Transformation Extender Advanced is affected by unsafe Java deserialization.

Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, is affected by unsafe Java deserialization. Vulnerability Details CVEID:CVE-2023-49886 DESCRIPTION: IBM Standards Processing Engine could allow a remote attacker to execute arbitrary code on the system,...

OpenSSH 安全漏洞

OpenSSH OpenBSD Secure Shell is a Canadian OpenBSD open source set of connection tools for secure access to remote computers. The tools are an open source implementation of the SSH protocol and support encryption of all transmissions, effectively blocking eavesdropping, connection hijacking, and...

PT-2025-51828

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.4 Description The application does not properly validate redirect URLs on the /error page. This allows an attacker to redirect a victim to a malicious site by crafting a link that, when opened in a new...

IBM Security Verify Access和IBM Security Verify Access Docker 操作系统命令注入漏洞

IBM Security Verify Access ISAM and IBM Security Verify Access Docker are both products of International Business Machines IBM.IBM Security Verify Access is a service that improves the security of user access.IBM Security Verify Access Docker is a service that can be used to configure a Security...

EUVD-2025-26165

Malicious code in bioql PyPI...

EUVD-2025-28135

Malicious code in bioql PyPI...

EUVD-2025-25895

Malicious code in bioql PyPI...

EUVD-2022-32374

Malicious code in bioql PyPI...

EUVD-2025-26264

Malicious code in bioql PyPI...

EUVD-2023-53783

Malicious code in bioql PyPI...

EUVD-2025-28553

Malicious code in bioql PyPI...

Security Bulletin: IBM Transformation Extender Advanced is could allow user impersonation.

Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, could allow an authenticated user to impersonate another user on the system. Vulnerability Details CVEID:CVE-2023-49881 DESCRIPTION: IBM Standards Processing Engine does not invalidate session after logou...

NewStart CGSL MAIN 6.06 : gcc Vulnerability (NS-SA-2025-0227)

The remote NewStart CGSL host, running version MAIN 6.06, has gcc packages installed that are affected by a vulnerability: - The POWER9 backend in GNU Compiler Collection GCC before version 10 could optimize multiple calls of the builtindarn intrinsic into a single call, thus reducing the entropy...

Dotnetnuke < 10.1.0 Stored XSS Using Backend Admin Credentials (CVE-2025-59546)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.1.0. It is, therefore, affected by a vulnerability. - DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to version 10.1....

CVE-2025-59539

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the websit...

CVE-2025-59821 DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases,...

CVE-2025-59546 DNN Vulnerable to Stored XSS Using Backend Admin Credentials

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to version 10.1.0, administrators and content editors can set html in module titles that could include javascript which could be used for XSS based attacks. This issue has been patched ...

PT-2025-39200

Name of the Vulnerable Software and Affected Versions DNN formerly DotNetNuke versions prior to 10.1.0 Description DNN formerly DotNetNuke is an open-source web content management platform. Versions prior to 10.1.0 have a javascript injection issue related to specially crafted URLs to the...