Wind River Software VxWorks 6.9 Weak Password Hashing Algorithms

The password hashing algorithm introduced in VxWorks 6.9 is considered insecure. This algorithm employs a single iteration of SHA-256 combined with a salt to hash user passwords. The password hashing algorithm used in VxWorks 7 24.04 is also considered insecure. This algorithm uses 5,000 iteratio...

DLA-4031-1 git - security update

Bulletin has no description...

HMS Networks Ewon Flexy 202

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to disclose sensitive user credentials. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for...

PT-2025-4986 · New Media One · New Media One Geodigs

Name of the Vulnerable Software and Affected Versions: New Media One GeoDigs versions prior to 3.4.1 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious script...

CVE-2025-21540

...

CVE-2025-21525

...

CVE-2025-21516

CVE-2025-21516 affects Oracle E-Business Suite Customer Care (Service Requests) in versions 12.2.5–12.2.13. The issue allows a low-privilege, unauthenticated or lightly authenticated attacker with network access via HTTP to compromise Oracle Customer Care, potentially leading to unauthorized crea...

CVE-2025-21507

...

CVE-2025-21505

CVE-2025-21505 affects Oracle MySQL Server (component: Server: Components Services). Affected versions include 8.0.40 and prior, 8.4.3 and prior, and 9.1.0 and prior. The vulnerability allows a high-privilege attacker who can reach the server over network through multiple protocols to cause a han...

CVE-2025-21499

...

MAL-2025-313 Malicious code in social-previews (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fab6484159a8754b4345d5eadcd2182865514fcfa93f939fe2999845cf79a803 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ZF Roll Stability Support Plus (RSSPlus)

RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated attacker to remotely proximal/adjacent with RF equipment call diagnostic functions which could impact both the availability and integrity. 2. RECOMMENDED PRACTICES CISA recommends users take defensive...

PT-2025-5253 · Anyroad · Anyroad

Name of the Vulnerable Software and Affected Versions: AnyRoad versions 1.3.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which affects AnyRoad. This allows for Cross Site Request Forgery. Recommendations: For versions 1.3.2 and earlier, update to a...

PT-2025-4237 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue is related to the Server: Optimizer component of MySQL Server, allowing an attacker with low privileges...

DLA-4025-1 redis - security update

Bulletin has no description...

The vulnerability of the TacJS module in the Drupal CMS system, related to the lack of protective measures for website structures, allows attackers to execute cross-site scripting attacks.

The vulnerability of the TacJS CMS system in Drupal is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

CVE-2024-36402 Unauthenticated writes to the media repository allow planting of problematic content in Matrix Media Repo

Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then...

PT-2025-4895 · Unknown · Visit Site Link

Name of the Vulnerable Software and Affected Versions: Visit Site Link enhanced versions n/a through 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

CVE-2025-21210

Windows BitLocker Information Disclosure Vulnerability...

Schneider Electric EcoStruxure (Update D)

RISK EVALUATION Successful exploitation of this vulnerability allows for local privilege escalation, which could lead to the execution of a malicious DLL. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:...