OESA-2025-2182 golang security update

. Security Fixes: The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS e.g. Git, but contains metadata for another VC...

📄 Ilevia EVE X1/X5 Server 4.7.18.0.eden Reverse Rootshell

Ilevia EVE X1/X5 Server version 4.7.18.0.eden reverse rootshell exploit. A misconfiguration in the sudoers file permits passwordless execution of specific Bash shell scripts via sudo, exposing a critical privilege escalation vulnerability. When such scripts are writable by a web-facing user...

PT-2025-36123

Name of the Vulnerable Software and Affected Versions: Gutentor versions through 3.5.1 Description: Gutentor is susceptible to a missing authorization issue, allowing exploitation of incorrectly configured access control security levels. Recommendations: At the moment, there is no information abo...

WordPress plugin Ray Enterprise Translation 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2025-23302

NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the LS10 could enable an attacker to set an unsafe debug access level. A successful exploit of this vulnerability might lead to denial of service...

CVE-2025-23302

NVIDIA HGX and DGX are affected by CVE-2025-23302 due to a LS10 misconfiguration that could enable an unsafe debug access level and cause denial of service. The official bulletin specifies remediation by updating LS10 to version 1.8.0 (affected versions prior to 1.7.1). Blackwell variants (HGX/DG...

CVE-2025-23301

NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the VBIOS could enable an attacker to set an unsafe debug access level. A successful exploit of this vulnerability might lead to denial of service...

CVE-2025-23301

The connected NVIDIA bulletin confirms CVE-2025-23301 affects NVIDIA HGX and DGX systems due to a misconfiguration in the VBIOS that could allow an attacker to set an unsafe debug access level, potentially causing a denial of service. Affected components/versions include VBIOS on Hopper HGX/DGX (...

IKEv2 misconfiguration can cause libreswan to abort and restart

...

CVE-2025-54599

The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own account and perform an SSO login. The roo...

NVIDIA DGX和NVIDIA HGX 安全漏洞

NVIDIA DGX and NVIDIA HGX are both products of NVIDIA Corporation, U.S.A. NVIDIA DGX is a high-performance workstation for deep learning applications.NVIDIA HGX is a modular GPU acceleration platform. A security vulnerability exists in NVIDIA DGX and NVIDIA HGX, which stems from a misconfiguratio...

PT-2025-35951

Name of the Vulnerable Software and Affected Versions: NVIDIA HGX and DGX affected versions not specified Description: NVIDIA HGX and DGX systems are susceptible to a misconfiguration in the LS10 component, potentially allowing an attacker to establish an unsafe debug access level. Exploitation o...

PT-2025-35950

Name of the Vulnerable Software and Affected Versions: NVIDIA HGX and DGX affected versions not specified Description: NVIDIA HGX and DGX systems are susceptible to a misconfiguration in the VBIOS that could allow an attacker to establish an unsafe debug access level. Exploitation of this issue m...

CVE-2025-58635

Missing Authorization vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through = 1.4.23...

CVE-2025-58210

Missing Authorization vulnerability in ThemeMove Makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through 1.8.5...

PT-2025-35750

Name of the Vulnerable Software and Affected Versions: Frisbii Pay versions through 1.8.2.1 Description: A missing authorization issue exists in Frisbii Pay, allowing exploitation due to incorrectly configured access control security levels. Recommendations: At the moment, there is no information...

PT-2025-35733

Name of the Vulnerable Software and Affected Versions: Order Delivery Date for WooCommerce versions through 4.1.0 Description: The software contains a missing authorization flaw due to incorrectly configured access control security levels. Recommendations: At the moment, there is no information...

CVE-2025-9273 CData API Server MySQL Misconfiguration Information Disclosure Vulnerability

CData API Server MySQL Misconfiguration Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of CData API Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

CVE-2025-9273

CVE-2025-9273 refers to a misconfiguration in CData API Server where MySQL connections are allowed to request local files from the MySQL client, enabling information disclosure in NETWORK SERVICE contexts. The flaw is tied to how the server handles MySQL connection options and does not indicate e...

CVE-2025-54599

The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own account and perform an SSO login. The roo...