Siemens SCALANCE LPE9403 操作系统命令注入漏洞

Siemens SCALANCE LPE9403 is a local processing engine for industrial field data processing from Siemens. It is used to capture, collect and pre-process industrial field data. The Siemens SCALANCE LPE9403 6GK5998-3GS00-2AC2 suffers from an operating system command injection vulnerability that...

CVE-2025-2043

A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /adminthemes of the component Add New Topic Handler. The manipulation of the argument Topic Key leads to deserialization. The attack may be initiated remotely...

CVE-2025-0177

The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileg...

CVE-2025-2043

A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /adminthemes of the component Add New Topic Handler. The manipulation of the argument Topic Key leads to deserialization. The attack may be initiated remotely...

CVE-2025-2043 LinZhaoguan pb-cms Add New Topic admin#themes deserialization

A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /adminthemes of the component Add New Topic Handler. The manipulation of the argument Topic Key leads to deserialization. The attack may be initiated remotely...

CVE-2025-2043

LinZhaoguan pb-cms 1.0.0 contains a deserialization flaw in the Add New Topic Handler when processing Topic Key in /admin#themes. This remote-native exploit may be used to trigger deserialization and is described as critical in CVE-2025-2043. Multiple sources corroborate the issue and its public ...

CVE-2024-12146

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Finder Fire Safety Finder ERP/CRM New System allows SQL Injection. This issue affects Finder ERP/CRM New System: before 18.12.2024...

Important: kernel-livepatch-5.10.230-223.885

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Fix slab-use-after-free read in sgrelease CVE-2024-56631 Affected Packages: kernel-livepatch-5.10.230-223.885 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Low: cups

Issue Overview: No CVE associated with this advisory Affected Packages: cups Issue Correction: Run dnf update cups --releasever 2023.6.20250303 or dnf update --advisory ALAS2023-2025-883 --releasever 2023.6.20250303 to update your system. More information on how to update your system can be found...

CLSA-2025-1741216500 Fix CVE(s): CVE-2024-31068, CVE-2024-36293, CVE-2024-39279

New microcode update packages from upstream up to 2025-02-11: - New microcodes: sig 0x000a06f3, pfmask 0x01, 2024-11-22, rev 0x3000330, size 1533952 sig 0x000b0674, pfmask 0x32, 2024-09-25, rev 0x012c, size 211968 sig 0x000b06f6, pfmask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x000b06f7,...

CLSA-2025-1741215575 Fix CVE(s): CVE-2024-31068, CVE-2024-36293, CVE-2024-39279

New microcode update packages from upstream up to 2025-02-11: - New microcodes: sig 0x000a06f3, pfmask 0x01, 2024-11-22, rev 0x3000330, size 1533952 sig 0x000b0674, pfmask 0x32, 2024-09-25, rev 0x012c, size 211968 sig 0x000b06f6, pfmask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x000b06f7,...

The vulnerability of the `new_stream_audio` function in the `fftools/ffmpeg_mux_init.c` file of the FFmpeg multimedia library allows a hacker to execute arbitrary code.

The vulnerability of the newstreamaudio function in the fftools/ffmpegmuxinit.c file of the FFmpeg multimedia library is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

firefox security update

128.8.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 128.8.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 128.8.0-1 - Update to 128.8.0 build1...

Linux Distros Unpatched Vulnerability : CVE-2022-3649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfsnewinode of the file fs/nilfs2/inode.c of the...

Control iD iDSecure 4.7.43.0 Add Administrator / Authentication Bypass

Control iD iDSecure version 4.7.43.0 exploit that adds an administrator. ============================================================================================================================================= | Title : Control iD iDSecure v4.7.43.0 PHP Code Injection Vulnerability | | Autho...

CVE-2024-55064

Multiple cross-site scripting XSS vulnerabilities in EasyVirt DC NetScope = 8.6.4 allow remote attackers to inject arbitrary JavaScript or HTML code via the 1 smtpserver, 2 smtpaccount, 3 smtppassword, or 4 emailrecipients parameter to /smtp/update; the 5 ntp or 6 dns parameter to...

Enhancing the Wordfence Bug Bounty Program: New Incentives & a Stronger Focus on High-Impact Research

Last year was a year of growth and refinement for the Wordfence Threat Intelligence team. In December of 2023, we launched our Bug Bounty Program, rewarding security researchers for identifying and reporting in-scope vulnerabilities to further our mission of Securing the Web while contributing to...

The New Ransomware Groups Shaking Up 2025

In 2024, global ransomware attacks hit 5,414, an 11% increase from 2023. After a slow start, attacks spiked in Q2 and surged in Q4, with 1,827 incidents 33% of the year's total. Law enforcement actions against major groups like LockBit caused fragmentation, leading to more competition and a rise ...

CVE-2024-55064

Multiple cross-site scripting XSS vulnerabilities in EasyVirt DC NetScope = 8.6.4 allow remote attackers to inject arbitrary JavaScript or HTML code via the 1 smtpserver, 2 smtpaccount, 3 smtppassword, or 4 emailrecipients parameter to /smtp/update; the 5 ntp or 6 dns parameter to...

SUSE CVE-2025-21813

In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fix off-by-one root mis-connection Before attaching a new root to the old root, the children counter of the new root is checked to verify that only the upcoming CPU's top group have been connected to it. However...