MAL-2025-1647 Malicious code in figma-plugins-and-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 250144845a9dd4a7a0bea8a44c06f50652890d4ab2f0fb860bb51a5a14ea1a54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-13358: Missing Authorization

The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bpdeletepage function in all versions up to, and including, 3.4.24. This makes it possible for authenticated...

Malicious code in webbundle-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c94c458984a089f14be87d45c3ac4355e1ba06610c50abbcbb0f172160e5a38e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1563 Malicious code in webbundle-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c94c458984a089f14be87d45c3ac4355e1ba06610c50abbcbb0f172160e5a38e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Debian dla-4071 : gstreamer1.0-gtk3 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4071 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4071-1 [email protected]...

[SECURITY] [DLA 4071-1] gst-plugins-good1.0 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4071-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès February 27, 2025 https://wiki.debian.org/LTS -...

Moderate: Red Hat Security Advisory: Red Hat Developer Hub 1.4.2 release.

Red Hat Developer Hub 1.4.2 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

Wordfence Intelligence Weekly WordPress Vulnerability Report (February 17, 2025 to February 23, 2025)

Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...

DLA-4071-1 gst-plugins-good1.0 - security update

Bulletin has no description...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Moby

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of Moby. Vulnerability Details CVEID:CVE-2024-41110 DESCRIPTION: Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine,...

Improper Authorization

Overview glpi/glpi is a free Asset and IT Management Software package with ITIL Service Desk, licenses tracking and software auditing. Affected versions of this package are vulnerable to Improper Authorization via the update.php file which allows an attacker to disable all active plugins by...

CVE-2025-23024

GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the install/update.php file...

UBUNTU-CVE-2025-23024

GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the install/update.php file...

CVE-2025-23024

GLPI (asset/IT management software) is affected by CVE-2025-23024 in versions prior to 10.0.18, where an anonymous user can disable all active plugins. The vendor patch is applied in 10.0.18. As a workaround, deletion of install/update.php is suggested. The CVSS and related metrics in the primary...

CVE-2025-23024

GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the "install/update.php" file...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: minio, dockerize, gomplate, newrelic-infrastructure-agent, chartmuseum, gke-gcloud-auth-plugin, kustomize, nri-mssql, cortex, nri-haproxy, mockery, temporal-server, kpt, kubernetes-csi-livenessprobe, rabbitmq-cluster-operator, velero, capslock, local-path-provisioner...

GHSA-8XFX-RJ4P-23JM vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler-fips, prometheus-node-exporter-fips, kubebuilder, dex-fips, kyverno-policy-reporter-kyverno-plugin, flux-kustomize-controller, xcaddy, minio-fips, nri-kafka, victoriametrics, stern, prometheus-operator, cri-tools, prometheus-beat-exporter,...

GHSA-J7VJ-RW65-4V26 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler-fips, prometheus-node-exporter-fips, kubebuilder, dex-fips, kyverno-policy-reporter-kyverno-plugin, flux-kustomize-controller, xcaddy, minio-fips, nri-kafka, victoriametrics, stern, prometheus-operator, cri-tools, prometheus-beat-exporter,...

GHSA-3F6R-QH9C-X6MM vulnerabilities

Vulnerabilities for packages: prometheus-node-exporter-fips, dex-fips, kyverno-policy-reporter-kyverno-plugin, flux-kustomize-controller, karma, xcaddy, aws-network-policy-agent-fips, kapp-controller, local-path-provisioner-fips, spark-operator-fips, prometheus-operator, cri-tools, podman,...

SUSE SLES15 / openSUSE 15 : Feature update for slurm and pdsh (SUSE-SU-SUSE-FU-2025:0660-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-SUSE-FU-2025:0660-1 advisory. slurm was updated to version 24.11.1 using package slurm2411: - Security issues fixed: CVE-2024-48936: Fixed authenticati...