Node.js Test CI Security Incident

Node.js Test CI Security Incident Update 23-April-2025 Node.js Test CI Security Incident – Full Disclosure Summary On March 21, 2025, we received a security report via HackerOne link restricted at time of writing, detailing a successful compromise of several Node.js test CI hosts. According to th...

A Sustainability Program with Regional Nuance

...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft

Video Tutorial !CVE-2025-24071 Demohttps://img.youtube.co...

naturalsheal.vn Cross Site Scripting vulnerability OBB-4047732

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

jw-elektronik.de Cross Site Scripting vulnerability OBB-4047624

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

BIT-MEDIAWIKI-2025-32698 LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/LogPager.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1...

The vulnerability of the bpf_program() function in the Linux kernel’s drivers/net/ppp/ppp_generic.c file allows a hacker to cause a service failure.

The vulnerability of the bpfprogram function in the Linux kernel’s drivers/net/ppp/pppgeneric.c file is related to the use of an uninitialized pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-3246

CVE-2025-3246 targets GitHub Enterprise Server, specifically version 3.16.1, via an improper neutralization of input that enables cross-site scripting in GitHub Markdown using $$..$$ math blocks. The issue requires access to the target instance and privileged user interaction with the malicious e...

CVE-2025-3509 Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation

A Remote Code Execution RCE vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vulnerability involves using dynamically...

CVE-2025-3509

CVE-2025-3509 affects GitHub Enterprise Server prior to 3.18 and is a Remote Code Execution in the pre-receive hook. The root cause involves using dynamically allocated ports that become temporarily available during specific operational conditions (e.g., hot patch upgrades), creating an exploitab...

[SECURITY] Fedora 41 Update: workrave-1.11.0~rc.1-1.fc41

Workrave is a program that assists in the recovery and prevention of Repetitive Strain Injury RSI. The program frequently alerts you to take micro-pauses, rest breaks and restricts you to your daily limit...

[SECURITY] Fedora 40 Update: workrave-1.11.0~rc.1-1.fc40

Workrave is a program that assists in the recovery and prevention of Repetitive Strain Injury RSI. The program frequently alerts you to take micro-pauses, rest breaks and restricts you to your daily limit...

WakaTime: user api key leaked

The user's API key was found exposed in an older URL while testing the WakaTime tool. The API key successfully authenticated requests to a restricted endpoint, indicating that it was valid and granted access to protected resources...

CVE-2025-31340

A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file...

PT-2025-16928 · Unknown · Wisdom Master Pro

Name of the Vulnerable Software and Affected Versions: Wisdom Master Pro versions 5.0 through 5.2 Description: A vulnerability in the retrieve course Information function of Wisdom Master Pro allows remote attackers to perform arbitrary system commands by running a malicious file due to improper...

CVE-2025-32787 SoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRA

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in DeleteIPv6DefaultRouterInRA called by StorePacket. Before dereferencing, DeleteIPv6DefaultRouterInRA does not account for ParsePacket returning NULL,...

‘Stupid and Dangerous’: CISA Funding Chaos Threatens Essential Cybersecurity Program

The CVE Program is the primary way software vulnerabilities are tracked. Its long-term future remains in limbo even after a last-minute renewal of the US government contract that funds it...

CVE Program Stays Online as CISA Backs Temporary MITRE Extension

MITRE avoids CVE program shutdown with last-minute contract extension. Questions remain about long-term funding and the future of…...

6,000 WordPress Sites Affected by Arbitrary File Move Vulnerability in Drag and Drop Multiple File Upload for WooCommerce WordPress Plugin

📢Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...

CVE Program Almost Unfunded

Mitre's CVE's program--which provides common naming and other informational resources about cybersecurity vulnerabilities--was about to be cancelled, as the US Department of Homeland Security failed to renew the contact. It was funded for eleven more months at the last minute. This is a big deal...