OPENSUSE-SU-2025:15444-1 framework_tool-0.4.5-2.1 on GA media

These are all security issues fixed in the frameworktool-0.4.5-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15452-1 postgresql15-15.14-1.1 on GA media

These are all security issues fixed in the postgresql15-15.14-1.1 package on the GA media of openSUSE Tumbleweed...

WordPress Plugin Assistant for NextGEN Gallery has a path traversal vulnerability

The WordPress Assistant for NextGEN Gallery plugin is a WordPress plugin that focuses on migrating the image uploading, processing and album management features of NextGEN Gallery from a website/browser to a desktop application running on a more powerful desktop system. The WordPress Assistant fo...

fractal-12.0-2.1 on GA media (moderate)

fractal-12.0-2.1 on GA media Announcement ID: openSUSE-SU-2025:15439-1 Rating: moderate Cross-References: CVE-2055-55159 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the fractal-12.0-2.1...

CVE-2025-7641: Improper Limitation of a Pathname to a Restricted Directory

The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated...

OPENSUSE-SU-2025:15445-1 gstreamer-devtools-1.26.5-1.1 on GA media

These are all security issues fixed in the gstreamer-devtools-1.26.5-1.1 package on the GA media of openSUSE Tumbleweed...

Slurm Resource Manager Data Compromise

The vulnerability of the Slurm resource manager is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

OPENSUSE-SU-2025:15449-1 nginx-1.29.1-1.1 on GA media

These are all security issues fixed in the nginx-1.29.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-22830

APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. A successful exploitation of this vulnerability may lead to resource exhaustion and impact Confidentiality, Integrity, and Availability...

CVE-2025-22834

AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Successful exploitation of this vulnerability may leave the resource in an unexpected state and potentially impact confidentiality, integrity, and availability...

CVE-2025-8953

A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /checkavailability.php. The manipulation of the argument employeeid leads to sql injection. The attack may be launched remotely. The exploit ha...

CVE-2025-8953

A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /checkavailability.php. The manipulation of the argument employeeid leads to sql injection. The attack may be launched remotely. The exploit ha...

CVE-2025-8953

CVE-2025-8953 affects SourceCodester COVID 19 Testing Management System 1.0. The vulnerability is a SQL injection in the file /check_availability.php caused by manipulation of the employeeid parameter, with remote exploitable access and a publicly disclosed exploit. Multiple trusted sources corro...

CVE-2025-8953 SourceCodester COVID 19 Testing Management System check_availability.php sql injection

A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /checkavailability.php. The manipulation of the argument employeeid leads to sql injection. The attack may be launched remotely. The exploit ha...

CVE-2025-8953 SourceCodester COVID 19 Testing Management System check_availability.php sql injection

A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /checkavailability.php. The manipulation of the argument employeeid leads to sql injection. The attack may be launched remotely. The exploit ha...

CVE-2025-42945

SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a victim with active user session into executing it. Upon successful exploit, this vulnerability could lead to limited access to data or it...

CVE-2025-42946

Due to directory traversal vulnerability in SAP S/4HANA Bank Communication Management, an attacker with high privileges and access to a specific transaction and method in Bank Communication Management could gain unauthorized access to sensitive operating system files. This could allow the attacke...

CVE-2025-42936

The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impac...

CVE-2025-42950

SAP Landscape Transformation SLT allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as...

CVE-2025-42941

SAP Fiori Launchpad is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pages. While administrative access is necessary...