WordPress plugin JSM Screenshot Machine Shortcode Cross-site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress JSM Screenshot Machine Shortcode plugin <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin JSM Screenshot Machine Shortcode versions = 2.3.0...

Malicious code in gouraud-lighting (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfc362cce48bdb5f578a8b148d9c1883aa7b66c4613c09379816e9ab15ca89e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from an FSM command timeout...

CVE-2024-49375 Remote Code Execution via Remote Model Loading in Rasa

Open source machine learning framework. A vulnerability has been identified in Rasa that enables an attacker who has the ability to load a maliciously crafted model remotely into a Rasa instance to achieve Remote Code Execution. The prerequisites for this are: 1. The HTTP API must be enabled on t...

CVE-2025-23042 Gradio Blocked Path ACL Bypass Vulnerability

Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path. This...

Malicious code in amzn-aws-glue-ml-libs-python (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e5986d73558862130dbb1317c6a92532786ec34f23d4d88c8fd6273198c5ce45 This is a couple of packages with names appearing to be a library for an AWS or other service. Their only behaviour is to call home on installation or import -...

January 14, 2025—KB5049984 (OS Build 25398.1369)

January 14, 2025—KB5049984 OS Build 25398.1369 Applies To Windows Server, version 23H2 Note For information about Windows update terminology, see the article about the types of Windows updates and the monthly quality update types. For an overview of Windows Server, version 23H2, see its update...

CVE-2024-12083 Path Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers

Path Traversal Vulnerabilities CWE-22 exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products...

CVE-2024-12083 Path Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers

Path Traversal Vulnerabilities CWE-22 exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products...

CVE-2024-12083: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal Vulnerabilities CWE-22 exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products...

Rasa security vulnerabilities

Rasa is an open source machine learning framework for automating text and speech based conversations. A security vulnerability exists in Rasa. An attacker exploiting the vulnerability can remotely execute code...

PT-2025-1746 · Nj-Series +1 · Nj Series +1

Name of the Vulnerable Software and Affected Versions: Machine Automation Controller NJ-series version 1.64.05 and lower Description: Path Traversal vulnerabilities exist in NJ/NX-series Machine Automation Controllers, allowing an attacker to perform unauthorized access and execute unauthorized...

CVE-2024-52937

Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory...

CVE-2024-47894

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory...

CVE-2024-52935

Kernel software running inside a Guest VM can exploit shared memory with the GPU Firmware to perform an out-of-bounds write (CWE-823) outside the virtualized GPU memory. This vulnerability affects Imagination Technologies PowerVR-GPU components, as confirmed in Android security bulletins. The iss...

CVE-2024-47895 GPU DDK - OOB read into fwlog due to unchecked block count

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory...

Using Veeam Agents with Xen Orchestra (Vates XCP-NG and XenServer)

Purpose This article documents how to use Veeam Agent for Microsoft Windows and Veeam Agent for Linux , managed by Veeam Backup & Replication, to protect virtual machines in XenServer and XCP-NG environments that are managed by Xen Orchestra. While these hypervisors are not directly supported for...

PT-2025-2942 · Kernel · Kernel

Name of the Vulnerable Software and Affected Versions: Kernel software affected versions not specified Description: The issue allows kernel software installed and running inside a Guest VM to exploit memory shared with the GPU Firmware, enabling it to write data outside the Guest's virtualised GP...

PT-2025-2943 · Imagination Technologies · Imagination Technologies Graphics Ddk

Name of the Vulnerable Software and Affected Versions: Imagination Technologies Graphics DDK version = 24.2 RTM2 Description: The kernel software installed and running inside a Guest VM may send improper commands to the GPU Firmware to subvert reconstruction activities and trigger a write of data...