CVE-2025-53692 Sitecore Experience Platform Cross-Site Scripting Vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Sitecore Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Cross-Site Scripting XSS.This issue affects Sitecore Experience Manager XM: from 9.2 through 10.4; Experience...

CVE-2025-7665

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handlemofirebaseformoptions' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to...

CVE-2025-59714

In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs...

Sitecore Experience Platform和Sitecore Experience Manager 安全漏洞

Sitecore Experience Platform XP and Sitecore Experience Manager XM are both products of Sitecore, a Danish company.Sitecore Experience Platform is a suite of customer digital experience platforms.Sitecore Sitecore Experience Platform is a customer digital experience platform and Sitecore Experien...

smb3: fix temporary data corruption in collapse range

...

smb3: fix temporary data corruption in insert range

...

CVE-2025-7665 Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handlemofirebaseformoptions' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to...

Threat landscape for industrial automation systems in Q2 2025

Statistics across all threats In Q2 2025, the percentage of ICS computers on which malicious objects were blocked decreased by 1.4 pp from the previous quarter to 20.5%. Percentage of ICS computers on which malicious objects were blocked, Q2 2022–Q2 2025 Compared to Q2 2024, the rate decreased by...

PT-2025-38538

Name of the Vulnerable Software and Affected Versions Bimser Solution Software Trade Inc. EBA Document and Workflow Management System versions 6.7.164 through 6.7.165 Description An improper authorization issue exists in Bimser Solution Software Trade Inc. EBA Document and Workflow Management...

Flying Drones to Locate Cyber-Attackers in LoRaWAN Metropolitan Networks

Today, many critical services and industrial systems rely on wireless networks for interaction with the IoT, hence becoming vulnerable to a broad number of cyber-threats. While detecting this kind of attacks is not difficult with common cyber-security tools, and even trivial for jamming, finding...

EUVD-2025-30249

Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For...

CVE-2023-53444

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix bulkmove corruption when adding a entry When the resource is the first in the bulkmove range, adding it again thus moving it to the tail will corrupt the list since the first pointer is not moved. This eventually lea...

CVE-2022-50391

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix memory leak in setmempolicyhomenode system call When encountering any vma in the range with policy other than MPOLBIND or MPOLPREFERREDMANY, an error is returned without issuing a mpolput on the policy just...

PT-2025-42246

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to index validation within configuration queues messaging in the i40e driver. Specifically, the issue occurs when iterating over vf-chidx in the...

mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...

CVE-2025-0420

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripting XSS. This issue affects Paraşüt: from 0.0.0.65efa44e through 20250204...

CVE-2025-0419

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Zirve Information Technologies Inc. Zirve Nova allows Cross-Site Scripting XSS. This issue affects Zirve Nova: from 235 through 20250131...

CVE-2025-0420 XSS in Mikrogrup's Paraşüt

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripting XSS. This issue affects Paraşüt: from 0.0.0.65efa44e through 20250204...

CVE-2025-0420 XSS in Mikrogrup's Paraşüt

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripting XSS. This issue affects Paraşüt: from 0.0.0.65efa44e through 20250204...

mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Thread Pooling. Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to...