OS Command Injection

Flowise is vulnerable to OS Command Injection. The vulnerability is due to minimal authentication and lack of RBAC, combined with default installations running without authentication, which allows an attacker to execute unsandboxed OS commands remotely...

pptp: ensure minimal skb length in pptp_xmit()

...

openSUSE Security Advisory (SUSE-SU-2025:02993-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 15: jetty-annotations / jetty-ant / jetty-cdi / jetty-client / etc (SUSE-SU-2025:02993-2)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02993-2 advisory. Upgraded to version 9.4.58.v20250814: - CVE-2025-5115: Fixed MadeYouReset DoS attack via HTTP/2 protocol including DNS over HTTPS bsc1244252 Tenable has...

SUSE-SU-2025:02993-2 Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: Upgraded to version 9.4.58.v20250814: - CVE-2025-5115: Fixed MadeYouReset DoS attack via HTTP/2 protocol including DNS over HTTPS bsc1244252...

SUSE-SU-2025:02993-1 Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: Upgraded to version 9.4.58.v20250814: - CVE-2025-5115: Fixed MadeYouReset DoS attack via HTTP/2 protocol including DNS over HTTPS bsc1244252...

SUSE: Security Advisory (SUSE-SU-2025:02993-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15: jetty-continuation / jetty-http / jetty-io / jetty-security / etc (SUSE-SU-2025:02993-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02993-1 advisory. Upgraded to version 9.4.58.v20250814: - CVE-2025-5115: Fixed MadeYouReset DoS attack via HTTP/2 protocol including DNS...

Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: Upgraded to version 9.4.58.v20250814: - CVE-2025-5115: Fixed MadeYouReset DoS attack via HTTP/2 protocol including DNS over HTTPS bsc1244252 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like...

MAL-2025-41293 Malicious code in heft-minimal-rig-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0a085da2f08feb8c00f2c512e03267a7ecdf55cb417d1d0cdb1f663604f95119 The OpenSSF Package Analysis project identified 'heft-minimal-rig-test' @ 99.0.9 npm as malicious. It is considered malicious because: - The...

Malicious code in heft-minimal-rig-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0a085da2f08feb8c00f2c512e03267a7ecdf55cb417d1d0cdb1f663604f95119 The OpenSSF Package Analysis project identified 'heft-minimal-rig-test' @ 99.0.9 npm as malicious. It is considered malicious because: - The...

SUSE CVE-2025-38574

In the Linux kernel, the following vulnerability has been resolved: pptp: ensure minimal skb length in pptpxmit Commit aabc6596ffb3 "net: ppp: Add bound checking for skb data on pppsynctxmung" fixed pppsynctxmunge We need a similar fix in pptpxmit, otherwise we might read uninit data as reported ...

CVE-2025-9138 Scada-LTS new cross site scripting

A vulnerability was found in Scada-LTS 2.7.8.1. Affected is an unknown function of the file pointHierarchy/new/. Performing manipulation of the argument Title results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Th...

NodeShield: Runtime Enforcement of Security-Enhanced SBOMs for Node.Js

The software supply chain is an increasingly common attack vector for malicious actors. The Node.js ecosystem has been subject to a wide array of attacks, likely due to its size and prevalence. To counter such attacks, the research community and practitioners have proposed a range of static and...

Malicious code in fluxible-minimal-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-6931 Malicious code in fluxible-minimal-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in finnlet-topbar-minimal (npm)

The package finnlet-topbar-minimal was found to contain malicious code...

MAL-2025-20578 Malicious code in finnlet-topbar-minimal (npm)

The package finnlet-topbar-minimal was found to contain malicious code...

CVE-2025-55192 HomeAssistant-Tapo-Control Code Injection Vulnerability in issues.yml Workflow

HomeAssistant-Tapo-Control offers Control for Tapo cameras as a Home Assistant component. Prior to commit 2a3b80f, there is a code injection vulnerability in the GitHub Actions workflow .github/workflows/issues.yml. It does not affect users of the Home Assistant integration itself — it only impac...

Malicious code in next-minimal-server (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bed5e4b150f949434786803be46122fa169432748424017c770c2582c50b6558 The OpenSSF Package Analysis project identified 'next-minimal-server'...