CVE-2024-12530

CVE-2024-12530 affects OpenText Secure Content Manager (Windows), specifically version 23.4, due to an Uncontrolled Search Path Element that enables DLL side-loading. This can allow end users to execute malicious code in the trusted context of the thick-client. The issue is locally exploitable wi...

PT-2025-17020 · Opentext · Opentext Secure Content Manager

Name of the Vulnerable Software and Affected Versions: OpenText Secure Content Manager version 23.4 Description: The issue is related to an Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows, which allows DLL Side-Loading. This could potentially be...

CVE-2024-12530: Uncontrolled Search Path Element

Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager: 23.4. End-users can potentially exploit the vulnerability to execute malicious code in the trusted context of the thick-client applicatio...

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2024-44192 webkitgtk: A malicious website may exfiltrate data cross-origin CVE-2024-54467...

CLSA-2025-1744782967 ghostscript: Fix of 3 CVEs

CVE-2024-33871: fix arbitrary code execution by restricting Driver parameter to load only known dynamic libraries in gdevopvp.c - CVE-2023-38559: fix buffer overflow flaw in devnpcxwriterle function by adding input validation checks - CVE-2024-29510: fix memory corruption and SAFER sandbox bypass...

freetype2:truetype-render-i38: Heap-buffer-overflow in af_latin_metrics_init

Detailed Report: https://oss-fuzz.com/testcase?key=6243898316095488 Project: freetype2 Fuzzing Engine: libFuzzer Fuzz Target: truetype-render-i38 Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x507000000a10 Crash State:...

ResolverRAT Campaign Targets Healthcare, Pharma via Phishing and DLL Side-Loading

Cybersecurity researchers have discovered a new, sophisticated remote access trojan called ResolverRAT that has been observed in attacks targeting healthcare and pharmaceutical sectors. "The threat actor leverages fear-based lures delivered via phishing emails, designed to pressure recipients int...

RequireJS Code Execution

The vulnerability of the s.contexts..configure function in the library for loading JavaScript modules using RequireJS is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or cause service...

Advisory ROSA-SA-2025-2842

Software: gdk-pixbuf2 2.36.12 OS: ROSA Virtualization 2.1 packageevrstring: gdk-pixbuf2-2.36.12-6.0.1.rv3 CVE-ID: CVE-2022-48622 BDU-ID: 2024-06670 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the GdkPixbuf image loading library is related to a heap memory corruption in aniloadchunk. Exploitation...

USN-7346-3 opensc vulnerabilities

USN-7346-1 fixed vulnerabilities in OpenSC. The update introduced a regression which broke smartcard based authentication. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenSC did not correctly handle certain memory operations...

ESET Command-line Scanner Code Execution

The vulnerability of ESET’s command-line scanner for anti-virus protection is related to an uncontrolled element in the loading process of the version.dll library. Exploiting this vulnerability can allow a hacker to execute arbitrary code...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Grub2 tarHandler Bypass

The vulnerability of the tarHandler component in the Grub2 operating system’s loader involves writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to bypass the secure loading mechanism...

Grub2 JPEG Loader Bypass

The vulnerability of JPEG files loaded by Grub2 operating systems is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to bypass the secure loading mechanism...

CVE-2025-30673

Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory '.' to be loaded similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code...

Multiple deserialization vulnerabilities in PyTorch Lightning 2.4.0 and earlier versions

Overview PyTorch Lightning versions 2.4.0 and earlier do not use any verification mechanisms to ensure that model files are safe to load before loading them. Users of PyTorch Lightning should use caution when loading models from unknown or unmanaged sources. Description PyTorch Lightning, a...

Pexip Infinity 安全漏洞

Pexip Infinity Pexip Video Conferencing Cloud Collaboration Platform is a video conferencing cloud collaboration platform from the Norwegian company Pexip. The product provides high quality and secure cloud conferencing capabilities. A security vulnerability exists in Pexip Infinity versions prio...

graphql-ruby: Remote code execution when loading a crafted GraphQL schema

A flaw was found in graphql-ruby. In affected versions of graphq-ruby, loading a malicious schema definition in the GraphQL::Schema.fromintrospection or the GraphQL::Schema::Loader.load can cause remote code execution. Any system that loads a schema by JSON from an untrusted source is vulnerable,...

graphql-ruby: Remote code execution when loading a crafted GraphQL schema

A flaw was found in graphql-ruby. In affected versions of graphq-ruby, loading a malicious schema definition in the GraphQL::Schema.fromintrospection or the GraphQL::Schema::Loader.load can cause remote code execution. Any system that loads a schema by JSON from an untrusted source is vulnerable,...

Cisco IOS XR Data Forgery Issue Vulnerability

Cisco IOS XR is a set of operating systems developed by the American company Cisco Cisco for its network equipment. Cisco IOS XR suffers from a data forgery vulnerability that stems from insufficient module validation during software loading, which could be exploited by an attacker to launch...