UBUNTU-CVE-2025-68225

In the Linux kernel, the following vulnerability has been resolved: lib/testkho: check if KHO is enabled We must check whether KHO is enabled prior to issuing KHO commands, otherwise KHO internal data structures are not initialized...

CVE-2025-68225

In the Linux kernel, the following vulnerability has been resolved: lib/testkho: check if KHO is enabled We must check whether KHO is enabled prior to issuing KHO commands, otherwise KHO internal data structures are not initialized...

CVE-2025-65074 OS Command Injection via Path Traversal in WaveStore Server

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to execute arbitrary OS commands on the server using path traversal in the showerr script. This issue was fixed in version...

Malicious code in raven-hubspot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 273a299e42e423bb2ac50f586ff57f8e869843110509c6d0e50b62dd9e91c228 The package raven-hubspot was found to contain malicious code. Source: ghsa-malware 6f62a48e9794e44ec492f8e1951f61f7953e08d5217b220ebcdea64d076a9d57...

MAL-2025-192597 Malicious code in raven-hubspot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 273a299e42e423bb2ac50f586ff57f8e869843110509c6d0e50b62dd9e91c228 The package raven-hubspot was found to contain malicious code. Source: ghsa-malware 6f62a48e9794e44ec492f8e1951f61f7953e08d5217b220ebcdea64d076a9d57...

MAL-2025-192584 Malicious code in jsondatatoruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89f78392e9a3a510c3e509f058c49aff59b8b98fff6beca0f5f30bbb8e85a9bd The package jsondatatoruby was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in jsondatatoruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89f78392e9a3a510c3e509f058c49aff59b8b98fff6beca0f5f30bbb8e85a9bd The package jsondatatoruby was found to contain malicious code. Source: ossf-package-analysis...

PT-2025-51712

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the kvaser usb leaf wait cmd and kvaser usb leaf read bulk callback functions related to handling zero-length commands used for aligning data to U...

PT-2025-51558

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to execute arbitrary OS commands on the server using path traversal in the showerr script. This issue was fixed in version...

PT-2025-51436

Name of the Vulnerable Software and Affected Versions AIOSEO Plugin Team Broken Link Checker versions through 1.2.6 Description The Broken Link Checker component contains a flaw due to improper neutralization of special elements within SQL commands, leading to a potential SQL Injection issue. Thi...

CVE-2023-53883

Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation. Attackers can create a new PHP page with malicious system commands in the description field to execute arbitrary commands on the server...

CVE-2023-53883

Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation. Attackers can create a new PHP page with malicious system commands in the description field to execute arbitrary commands on the server...

CVE-2023-53888 Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation

Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files such as JavaScript and rename them to .php via the saveE and rename actions, then execute the...

CVE-2023-53883 Webedition CMS v2.9.8.8 Remote Code Execution via PHP Page Creation

Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation. Attackers can create a new PHP page with malicious system commands in the description field to execute arbitrary commands on the server...

CVE-2023-53881

CVE-2023-53881 affects ReyeeOS 1.204.1614 and stems from unencrypted CWMP communications that enable a man-in-the-middle to intercept and manipulate device traffic. The vulnerability allows an attacker to impersonate a CWMP server and inject/execute arbitrary commands on Ruijie Reyee Cloud device...

GO-2025-4204 Mattermost Server does not properly restrict use of slash commands in github.com/mattermost/mattermost-server

Mattermost Server does not properly restrict use of slash commands in github.com/mattermost/mattermost-server...

CVE-2025-11393

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...

CVE-2025-11393

The CVE-2025-11393 entry concerns a misconfigured internal proxy in runtimes-inventory-rhel8-operator. The root cause is an internal proxy component that attaches the cluster’s main administrative credentials to any command, enabling a standard user to issue unauthorized commands with full cluste...

CVE-2025-11393 Insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commands

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...

CVE-2025-11393

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...