CVE-2025-32923

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GoodLayers Tourmaster tourmaster allows Reflected XSS.This issue affects Tourmaster: from n/a through 5.4.1...

CVE-2025-30727

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite component: iSurvey Module. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful...

CVE-2025-30695

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2025-21584

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

CVE-2024-42193

HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibility of man-in-the-middle MITM attacks and data exposure as, if exploited, this vulnerability could potentially lead to unauthorized acces...

CVE-2025-24358

The CVE-2025-24358 issue affects gorilla/csrf across Go web apps, where prior to 1.7.2 the Origin header wasn’t validated against an allowlist and Referer checks were gated by a TLS-detection that misbehaves for server requests. Attackers with XSS on a subdomain/top‑level domain could submit auth...

CVE-2025-32947

CVE-2025-32947 concerns PeerTube. The connected documents describe a DoS via an infinite loop in the "+inbox+" endpoint triggered by crafted ActivityPub activities, causing the PeerTube server to stop responding to requests. Affected software is PeerTube; the root cause is an infinite loop in han...

CVE-2025-26954

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 1pluginjquery ZooEffect 1-jquery-photo-gallery-slideshow-flash allows Reflected XSS.This issue affects ZooEffect: from n/a through = 1.11...

Moderate: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)

A flaw was found in Xen hypercall page handling within virtualized guest environments. The Xen hypercall page contains code generated by the hypervisor that lacks awareness of guest operating system CPU speculation mitigations, such as return instruction transforms, and Control-flow Integrity CFI...

kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)

A flaw was found in Xen hypercall page handling within virtualized guest environments. The Xen hypercall page contains code generated by the hypervisor that lacks awareness of guest operating system CPU speculation mitigations, such as return instruction transforms, and Control-flow Integrity CFI...

Moderate: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Growatt Cloud Applications

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to compromise confidentiality, achieve cross-site scripting, or code execution on affected devices. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation...

Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple security vulnerabilities

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana OnPrem build 1.0.287 Vulnerability Details CVEID:CVE-2024-47561 DESCRIPTION: Apache Avro could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in schema parsing in th...

Security Bulletin: A vulnerability in IBM Robotic Process Autmation could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks (CVE-2024-51456).

Summary A vulnerability in IBM Robotic Process Autmation could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks. This bulletin identifies the fixes or remediations available to resolve this vulnerability. Vulnerability Details...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl which is vulnerable to CVE-2024-23829, CVE-2023-49082, CVE-2024-23334 and CVE-2023-49081

Summary IBM Maximo Application Suite - IoT Component uses aiohttp-3.8.6-cp37-cp37m-manylinux217x8664.manylinux2014x8664.whl which is vulnerable to CVE-2024-23829, CVE-2023-49082, CVE-2024-23334 and CVE-2023-49081. This bulletin contains information regarding the vulnerability and its fixture...

Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities

Summary There are vulnerabilities in IBM® Java™ Version 8 used by IBM Cognos Dashboards on Cloud Pak. IBM Cognos Dashboards on Cloud Pak has addressed these vulnerabilities by upgrading IBM® Java™. There are vulnerabilities in Open-Source Software OSS components consumed by IBM Cognos Dashboards ...

PT-2025-16422

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.0 through 8.0.41 MySQL Server versions 8.4.0 through 8.4.4 MySQL Server versions 9.0.0 through 9.2.0 Description The issue allows a low-privileged attacker with network access via multiple protocols to compromise MySQ...

PT-2025-16401

Name of the Vulnerable Software and Affected Versions: Oracle Commerce Platform versions 11.3.0 through 11.3.2 Description: The issue allows a low-privileged attacker with network access via HTTP to compromise the Oracle Commerce Platform. Successful attacks require human interaction from a perso...

Improved MST3 Encryption Scheme Based on Small Ree Groups

This article presents an encryption scheme based on the small Ree groups. We propose utilizing the small Ree group structure to enhance the overall security parameters of the encryption scheme. By extending the logarithmic signature to encompass the entire group and modifying the encryption...