Security Bulletin: A Security Vulnerability was fixed in IBM Application Gateway.

Summary IBM Security Application Gateway is vulnerable to cross-site scripting. This has been fixed in IBM Application Gateway 22.07 Vulnerability Details CVEID:CVE-2022-22387 DESCRIPTION: IBM Application Gateway is vulnerable to cross-site scripting. This vulnerability allows users to embed...

CVE-2024-55964

An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must be able to access Appsmith, login to it, create a datasource, create a query against that...

docker-stable-24.0.9_ce-8.1 on GA media (moderate)

docker-stable-24.0.9ce-8.1 on GA media Announcement ID: openSUSE-SU-2025:14923-1 Rating: moderate Cross-References: CVE-2025-22868 CVE-2025-22869 CVSS scores: CVE-2025-22868 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-22868 SUSE : 8.7...

CVE-2024-55964

An incorrectly configured PostgreSQL instance within the Appsmith Docker image allows for remote command execution (RCE) inside the container. This vulnerability affects Appsmith versions prior to 1.52 . To exploit this, an attacker must possess the ability to access the application, authenticate...

CVE-2024-55964: Improper Control of Generation of Code

An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must be able to access Appsmith, login to it, create a datasource, create a query against that...

Exploit for CVE-2025-1974

README Talk is cheap, just look at the code. Detailed can be...

OPENSUSE-SU-2025:14923-1 docker-stable-24.0.9_ce-8.1 on GA media

These are all security issues fixed in the docker-stable-24.0.9ce-8.1 package on the GA media of openSUSE Tumbleweed...

Appsmith RCE

An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. Module Options msf use exploit/linux/http/appsmith/rcecve202455964 msf undefinedrcecve202455964 show actions ...actions... msf undefinedrcecve202455964 set...

SUSE SLES12 Security Update : docker (SUSE-SU-2025:0992-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:0992-1 advisory. Update to Docker 27.5.1-ce bsc1237335: - CVE-2024-29018: External DNS requests from 'internal' networks could lead to data exfiltration bsc1234089...

SUSE-SU-2025:0992-1 Security update for docker

This update for docker fixes the following issues: Update to Docker 27.5.1-ce bsc1237335: - CVE-2024-29018: External DNS requests from 'internal' networks could lead to data exfiltration bsc1234089...

Security update for docker

This update for docker fixes the following issues: Update to Docker 27.5.1-ce bsc1237335: CVE-2024-29018: External DNS requests from 'internal' networks could lead to data exfiltration bsc1234089. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like...

CVE-2024-7771

A vulnerability in the Dockerized version of mintplex-labs/anything-llm latest, digest 1d9452da2b92 allows for a denial of service. Uploading an audio file with a very low sample rate causes the functionality responsible for transcribing it to crash the entire site instance. The issue arises from...

CVE-2024-13060

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1...

CVE-2024-8060

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...

CVE-2021-41089 vulnerabilities

Vulnerabilities for packages: docker...

GHSA-V994-F8VW-G7J4 vulnerabilities

Vulnerabilities for packages: docker...

GHSA-V994-F8VW-G7J4 vulnerabilities

Vulnerabilities for packages: docker...

CVE-2021-41089 vulnerabilities

Vulnerabilities for packages: docker...

Unintended Secret Exposure

github.com/docker/buildx is vulnerable to unintended secret exposure. The vulnerability is due to improper handling of sensitive data in OpenTelemetry traces and BuildKit daemon's history records, that allows an attacker to access sensitive secrets by extracting them...

GHSA-FF5C-56M7-VC75 Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...