The vulnerability of the cross-platform integrated development environment JetBrains Rider, related to bypassing the relative path, allows a malicious user to gain read, modify, or delete access to data.

The vulnerability of the cross-platform integrated software development environment JetBrains Rider is related to the exploitation of a relative path. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain read, modify, or delete access to data...

CVE-2023-53040

In the Linux kernel, the following vulnerability has been resolved: ca8210: fix maclen negative array access This patch fixes a buffer overflow access of skb-data if ieee802154hdrpeekaddrs fails...

Security Bulletin: Multiple vulnerabilities in Java affect IBM Business Automation Workflow - October 2024 CPU

Summary IBM Business Automation Workflow traditional includes IBM Java 8. Information about security vulnerabilities in these Java runtumes have been published. Vulnerability Details CVEID:CVE-2024-21235 DESCRIPTION: Vulnerability in Java SE component: Hotspot. Difficult to exploit vulnerability...

CVE-2025-3707 Sunnet eHRD CTMS - SQL Injection

The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL command to read database contents...

CVE-2025-37749

In the Linux kernel, the following vulnerability has been resolved: net: ppp: Add bound checking for skb data on pppsynctxmung Ensure we have enough data in linear buffer from skb before accessing initial bytes. This prevents potential out-of-bounds accesses when processing short packets. When...

CVE-2025-37749 net: ppp: Add bound checking for skb data on ppp_sync_txmung

In the Linux kernel, the following vulnerability has been resolved: net: ppp: Add bound checking for skb data on pppsynctxmung Ensure we have enough data in linear buffer from skb before accessing initial bytes. This prevents potential out-of-bounds accesses when processing short packets. When...

CVE-2025-23151 bus: mhi: host: Fix race between unprepare and queue_buf

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queuebuf A client driver may use mhiunpreparefromtransfer to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same...

CVE-2025-23151 bus: mhi: host: Fix race between unprepare and queue_buf

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queuebuf A client driver may use mhiunpreparefromtransfer to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same...

CVE-2025-3929

An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and...

ASB-A-200034476

In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution

A flaw was found in Artifex Ghostscript's psi/zfile.c component. This vulnerability allows arbitrary code execution via out-of-bounds data access...

ZTE GoldenDB Information Disclosure Vulnerability

ZTE GoldenDB is a financial-grade transactional distributed database from China's ZTE Corporation ZTE. It is used in finance, government and enterprise, telecom and other industries to provide highly available data services. An information leakage vulnerability exists in ZTE GoldenDB, which can b...

The vulnerability in the web interface of the Cisco AsyncOS operating system’s account management system allows a malicious individual to gain unauthorized access to protected information. This vulnerability in the Content Security Management Appliance system enables unauthorized access to protected data.

The vulnerability of the web interface of the Cisco AsyncOS operating system’s account management system relates to access control errors. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

Security Bulletin: InfoSphere Data Replication is affected by multiple postgresql vulnerbilities

Summary InfoSphere Data Replication uses postgresql. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2022-26520 DESCRIPTION: pgjdbc could allow a remote attacker to execute arbitrary code on the system, caused by the external control of the...

CVE-2025-3929

An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and...

CVE-2025-3929 Stored XSS vulnerability in MDaemon Email Server

An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and...

CVE-2025-3929

CVE-2025-3929 concerns the MDaemon Email Server (versions 25.0.1 and below). The issue is a stored XSS vulnerability where an attacker can send a specially crafted HTML email containing JavaScript in an img tag. When viewed in a webmail client, this could execute arbitrary JavaScript in the user’...

CVE-2025-3929 Stored XSS vulnerability in MDaemon Email Server

An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and...

Information Disclosure

moodle/moodle is vulnerable to an Information Disclosure. The vulnerability is due to inadequate input validation and authorization checks within the messaging web service, allows users to access data they are not authorized to view, such as other users' names and online statuses...

CVE-2025-32354

In Zimbra Collaboration ZCS 9.0 through 10.1, a Cross-Site Request Forgery CSRF vulnerability exists in the GraphQL endpoint /service/extension/graphql of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying...