CVE-2025-39530

CVE-2025-39530 refers to a CSRF-to-Stored-XSS vulnerability in the WordPress plugin “Site Search 360” (WordPress Site Search 360) affecting versions up to 2.1.7. The NVD entry and Red Hat advisory describe cross-site request forgery that enables stored XSS with a CVSS v3.1 base score of 7.1 (HIGH...

OpenJDK 8 <= 8u442 / 11.0.0 <= 11.0.26 / 17.0.0 <= 17.0.14 / 21.0.0 <= 21.0.6 / 24.0.0 <= 24.0.0 Multiple Vulnerabilities (2025-04-15)

The version of OpenJDK installed on the remote host is 8 prior to 8u442 / 11.0.0 prior to 11.0.26 / 17.0.0 prior to 17.0.14 / 21.0.0 prior to 21.0.6 / 24.0.0 prior to 24.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the 2025-04-15 advisory. Please Note: Java CVEs do...

AZL-62157 CVE-2025-21579 affecting package mysql for versions less than 8.0.42-1

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Options. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

Security Bulletin: Vulnerabilities in Flatpak affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary Potential vulnerabilities in Flatpak has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-32462 DESCRIPTION: Flatpak could allow a local...

GHSA-4WWW-5P9H-95MH http-proxy-middleware can call writeBody twice because "else if" is not used

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerability which can allow remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser

Summary A vulnerability has been identified under which sensitive application information might be leaked to a remote attacker when a detailed technical error message is returned in the browser which is being used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains...

PT-2025-16415

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.0 through 8.0.41 MySQL Server versions 8.4.0 through 8.4.4 MySQL Server versions 9.0.0 through 9.2.0 Description The issue allows a high-privileged attacker with network access via multiple protocols to compromise MyS...

http-proxy-middleware 安全漏洞

http-proxy-middleware is a Node.js http proxy middleware for connect, express, next.js, etc. by Steven Chim Personal Developer. A security vulnerability exists in http-proxy-middleware versions prior to 2.0.8 and prior to 3.0.4, which stems from the fact that writeBody may be called twice...

Oracle Database Server 安全漏洞

Oracle Database Server is a relational database management system from Oracle Corporation USA. This database management system provides data management, distributed processing, and other functions. A security vulnerability in the RAS Security component of Oracle Database Server, versions 19.3...

SquirrelMail <= 1.4.23, 1.5.x <= 1.5.2 XSS Vulnerability

SquirrelMail is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-16460 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.14 Description: The issue allows an unauthenticated attacker with network access via HTTP to compromise the Oracle Application Object Library, resulting in unauthorized read access to a...

Joomla! Authentication Bypass Vulnerability (20250402)

Joomla! is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...

CVE-2025-2469

An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.9.6, and 17.10 before 17.10.4. The runtime profiling data of a specific service was accessible to unauthenticated users...

CVE-2025-32119

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CardGate CardGate Payments for WooCommerce cardgate allows Blind SQL Injection.This issue affects CardGate Payments for WooCommerce: from n/a through = 3.2.1...

BIT-GITLAB-2025-2469 Debug Messages Revealing Unnecessary Information in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.9.6, and 17.10 before 17.10.4. The runtime profiling data of a specific service was accessible to unauthenticated users...

CVE-2025-30660

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine pfe of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS.When processing a high rate of specific GRE traffic destined to th...

CVE-2025-3131

Cross-Site Request Forgery CSRF vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2...

CVE-2025-23388 Unauthenticated stack overflow in /v3-public/authproviders API

A Stack-based Buffer Overflow vulnerability in SUSE rancher allows for denial of service.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3...

CVE-2025-32600

CVE-2025-32600: Reflected XSS in Tournamatch. Affected: Tournamatch versions up to 4.6.1 (no fixed version stated in provided docs). Root cause: improper neutralization of input during web page generation leading to reflected cross-site scripting. Severity: CVSS v3.1 base score 7.1 (HIGH) with ne...

CVE-2025-31040 WordPress WP Food ordering and Restaurant Menu plugin <= 2.7 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Exthemes WP Food ordering and Restaurant Menu wp-food allows PHP Local File Inclusion.This issue affects WP Food ordering and Restaurant Menu: from n/a through = 2.7...