PT-2025-34995

Name of the Vulnerable Software and Affected Versions: Savyour Affiliate Partner versions through 2.1.4 Description: A Cross-Site Request Forgery CSRF vulnerability exists in Savyour Affiliate Partner, which also allows Stored Cross-Site Scripting XSS. Recommendations: Update Savyour Affiliate...

WordPress Savyour Affiliate Partner plugin <= 2.1.4 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Savyour Affiliate Partner versions = 2.1.4...

Linux Distros Unpatched Vulnerability : CVE-2025-37986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: usb: typec: class: Invalidate USB device pointers on partner unregistration To avoid using...

Bykea: Customer can cancel a individual booking in a batch, causing locking of partner.

The vulnerability allowed users to update the status of individual trips inside a batch, even though only batch-level status changes were intended. By cancelling the single trip inside a one-parcel batch, the batch was placed into an inconsistent state, causing the assigned partner to become stuc...

Linux Distros Unpatched Vulnerability : CVE-2025-37809

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: usb: typec: class: Fix NULL pointer access Concurrent calls to typecpartnerunlinkdevice can...

Linux Distros Unpatched Vulnerability : CVE-2025-37994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: ucsi: displayport: Fix NULL pointer access This patch ensures that the UCSI driver waits for all pending tasks in the ucsidisplayportwork workqueue ...

kernel: usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Fix NULL pointer dereference in tcpmpdsvdm It is possible that typecregisterpartner returns ERRPTR on failure. When port-partner is an error, a NULL pointer dereference may occur as shown below. 91222.095236 T31...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to FreeType Remote Code Execution Vulnerability (CVE-2025-27363)

Summary IBM Sterling Partner Engagement Manager uses FreeType has part of the package and is affected by CVE-2025-27363 for versions 2.13.0 and below. Vulnerability Details CVEID:CVE-2025-27363 DESCRIPTION: An out of bounds write exists in FreeType versions 2.13.0 and below newer versions of...

CVE-2025-6077

Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions...

CVE-2025-6077

Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions...

CVE-2025-6078

Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input, making it possible to add notes with HTML tags and JavaScript, enabling an attacker to add a note...

CVE-2025-6078 CVE-2025-6078

Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input, making it possible to add notes with HTML tags and JavaScript, enabling an attacker to add a note...

CVE-2025-6078

CVE-2025-6078 affects Partner Software’s Partner Software and Partner Web applications. An authenticated user can submit notes on the Notes page in a job view, and input is not fully sanitized, allowing HTML/JavaScript in notes and resulting in stored XSS. Public details from multiple sources con...

CVE-2025-6077 CVE-2025-6077

Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions...

CVE-2025-6077 CVE-2025-6077

Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions...

CVE-2025-6077

CVE-2025-6077 concerns Partner Software’s Partner Software Product and Partner Web application, where the administrator account uses the same default username and password across all versions. Multiple sources confirm the issue can enable unauthorized admin access and, per CERT/industry notes, ma...

Partner Software和Partner Software Partner Web 安全漏洞

Partner Software and Partner Software Partner Web are both products of Partner Software, a U.S.-based company.Partner Software is a geographic information system application.Partner Software Partner Web is a back-end system that provides review of reports on the Partner Software is a GIS...

Partner Software和Partner Software Partner Web 安全漏洞

Partner Software and Partner Software Partner Web are both products of Partner Software, a U.S.-based company.Partner Software is a geographic information system application.Partner Software Partner Web is a back-end system that provides review of reports on the Partner Software is a GIS...

Partner Software和Partner Software Partner Web 安全漏洞

Partner Software and Partner Software Partner Web are both products of Partner Software, a U.S.-based company.Partner Software is a geographic information system application.Partner Software Partner Web is a back-end system that provides review of reports on the Partner Software is a GIS...

Partner Software/Partner Web does not sanitize Report files and Note content, allowing for XSS and RCE

Overview Partner Software and Partner Web, both products of their namesake company, Partner Software, fail to sanitize report or note files, allowing for XSS attacks. Partner Software is subdivision of N. Harris Computer Corporation and is a field application development company, with products...