Security Bulletin: IBM Cognos Transformer is affected by vulnerabilities in IBM® Java™

Summary There are vulnerabilities in IBM® Java™ Version 8 used by IBM Cognos Transformer. Vulnerability Details CVEID:CVE-2024-21131 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low integrity impact. CVSS Source: IBM X-For...

CVE-2025-52555 CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS

Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is tha...

PT-2025-27012

Name of the Vulnerable Software and Affected Versions: Ceph versions 17.2.7, 18.2.1 through 18.2.4, 19.0.0 through 19.2.2 Description: Ceph is a distributed object, block, and file storage platform. An unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by changing the...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

...

The vulnerability of the kvm_riscv_vcpu_sbi_init() function in the arch/riscv/kvm/vcpu_sbi.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the kvmriscvvcpusbiinit function in the arch/riscv/kvm/vcpusbi.c module of the Linux operating system is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protect...

The vulnerability of the bch2_sb_clean_validate_late() function in the fs/bcachefs/sb-clean.c module of the bcachefs file system support in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the bch2sbcleanvalidatelate function in the fs/bcachefs/sb-clean.c module of the bcachefs file system support module in the Linux operating system is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the wdt_startup() function in the drivers/watchdog/sc520_wdt.c module exposes the security of Linux kernel watchdog timer support, allowing an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the wdtstartup function in the drivers/watchdog/sc520wdt.c module related to Linux kernel watchdog timer support stems from the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Vulnerability of the save_iaa_wq() function in the drivers/crypto/intel/iaa/iaa_crypto_main.c module – a driver for the Intel cryptographic accelerator in the Linux operating system, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

Vulnerability of the saveiaawq function in the drivers/crypto/intel/iaa/iaacryptomain.c module – The Linux kernel cryptographic accelerator driver has a vulnerability related to insufficient validation of input data when dividing by zero. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the Telpo MDM mobile device management platform lies in its ability to disclose information through registration files. This allows a malicious actor to gain unauthorized access to the system with administrative rights and to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Telpo MDM mobile device management platform lies in the ability to disclose information through registration files. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to the system with administrative privileges and compromise the...

GHSA-RQPX-F6RC-7HM5 PowSyBl Core contains Polynomial REDoS’es

Impact What kind of vulnerability is it? Who is impacted? This is an advisory for a potential polynomial Regular Expression Denial of Service ReDoS vulnerability in the PowSyBl's DataSource mechanism. When the listNamesString regex method is called on a DataSource, the user-supplied regular...

Security Bulletin: IBM Security Guardium is affected by vulnerabilities in Oracle MySQL

Summary IBM Security Guardium has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2024-21137 DESCRIPTION: An unspecified vulnerability in Oracle MySQL Server related to the Server: Optimizer component could allow a remote authenticated attacker to cause high...

CVE-2025-49081

There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with system administrator permissions can impair the availability of the Secure Access administrative UI by writing invalid data to the warehouse...

CVE-2025-49081

There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with system administrator permissions can impair the availability of the Secure Access administrative UI by writing invalid data to the warehouse...

CVE-2025-49081

There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with system administrator permissions can impair the availability of the Secure Access administrative UI by writing invalid data to the warehouse...

CVE-2025-49081 Input validation vulnerability in the Secure Access prior to version 13.55

There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with system administrator permissions can impair the availability of the Secure Access administrative UI by writing invalid data to the warehouse...

CVE-2025-49081

CVE-2025-49081 is an input-validation flaw in the warehouse component of Absolute Secure Access, prior to server version 13.55. Attackers with system administrator privileges can impair the availability of the Secure Access administrative UI by sending invalid data over the network. No confidenti...

CVE-2025-42995

SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confidentiality and integrity of the...

PT-2025-25342 · Unknown · Absolute Secure Access

Name of the Vulnerable Software and Affected Versions: Absolute Secure Access versions prior to 13.55 Description: The issue is related to insufficient input validation in the warehouse component. Attackers with system administrator permissions can impair the availability of the Secure Access...

BIT-MARIADB-MIN-2023-22084

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Serve...

BIT-MARIADB-MIN-2022-21595

Vulnerability in the MySQL Server product of Oracle MySQL component: C API. Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...