Medium: tomcat10

Issue Overview: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, fr...

PT-2025-26634

Name of the Vulnerable Software and Affected Versions: pbkdf2 versions 3.0.10 through 3.1.2 Description: The issue is related to an Improper Input Validation vulnerability in pbkdf2, allowing Signature Spoofing by Improper Validation. This vulnerability is associated with program files...

PT-2025-26607

Name of the Vulnerable Software and Affected Versions: MLflow versions prior to 3.1.0 Description: The issue is related to the gateway proxy handler in MLflow, which lacks gateway path validation. This could potentially lead to exploitation. Recommendations: For versions prior to 3.1.0, update to...

PT-2025-26636 · Mitel · Mitel Openscape Xpressions

Name of the Vulnerable Software and Affected Versions: Mitel OpenScape Xpressions versions through V7R1 FR5 HF43 P913 Description: A vulnerability in the WebApl component could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful...

PT-2025-26586

Name of the Vulnerable Software and Affected Versions sslh versions prior to 2.2.2 Description An improper link resolution issue, known as link following, exists in sslh, a protocol multiplexor used to share SSH and HTTPS on the same port. The software fails to properly handle symbolic links when...

PT-2025-26602 · Jetbrains +1 · Teamcity +1

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.03.3 Description: The issue concerns reflected XSS in the NPM Registry integration. Recommendations: For versions prior to 2025.03.3, update to version 2025.03.3 or later to resolve the issue...

PT-2025-26592 · Innoshop · Innoshop

Name of the Vulnerable Software and Affected Versions: Innoshop versions 0.4.1 and earlier Description: The issue allows an authenticated attacker to achieve code execution on the server by exploiting the File Manager functions in the admin panel. This is done by uploading a crafted file and then...

PT-2025-26610 · Ncr · Ncr Terminal Handler

Name of the Vulnerable Software and Affected Versions: NCR Terminal Handler version 1.5.1 Description: The issue allows low-level privileged authenticated attackers to arbitrarily deactivate, lock, and delete user accounts via a crafted session cookie. Recommendations: For NCR Terminal Handler...

PT-2025-26611 · Ncr · Ncr Terminal Handler

Name of the Vulnerable Software and Affected Versions: NCR Terminal Handler version 1.5.1 Description: A CSV injection issue allows attackers to execute arbitrary commands by injecting a crafted payload into any text field that accepts strings. Recommendations: For NCR Terminal Handler version...

PT-2025-26641

Name of the Vulnerable Software and Affected Versions: Texas Instruments LP-CC2652RB SimpleLink CC13XX CC26XX SDK version 7.41.00.17 Description: An issue in the Texas Instruments LP-CC2652RB SimpleLink CC13XX CC26XX SDK allows attackers to cause a Denial of Service DoS via sending a crafted LL...

Medium: tomcat9

Issue Overview: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, fr...

PT-2025-26587 · Unknown · Pointcloudlibrary

Name of the Vulnerable Software and Affected Versions: PointCloudLibrary PCL versions prior to 1.14.0 Description: The issue is related to a memory corruption vulnerability in the Point Cloud Library PCL, specifically in the CRC32 module, associated with the program files crc32.C. This...

PT-2025-26639

Name of the Vulnerable Software and Affected Versions: pbkdf2 versions =3.1.2 Description: The issue is related to an Improper Input Validation vulnerability in pbkdf2, allowing Signature Spoofing by Improper Validation. Recommendations: For versions =3.1.2, update to a version greater than 3.1.2...

PT-2025-26582

Name of the Vulnerable Software and Affected Versions: WSO2 products affected versions not specified Description: An incorrect authorization issue exists, allowing unauthorized access to versioned files stored in the registry. This is due to flawed authorization logic, which can be exploited by a...

PT-2025-26598 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.03.3 Description: A DOM-based XSS issue was found at the Performance Monitor page. Recommendations: For versions prior to 2025.03.3, update to version 2025.03.3 or later to resolve the issue...

Medium: tomcat10

Issue Overview: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, fr...

PT-2025-26665 · Letmein · Letmein

Name of the Vulnerable Software and Affected Versions: Letmein versions prior to 10.2.1 Description: The connection limiter in Letmein is implemented incorrectly, allowing an arbitrary amount of simultaneously incoming connections for the services letmeind and letmeinfwd. This makes the command...

PT-2025-26651

Name of the Vulnerable Software and Affected Versions: 70mai M300 up to 20250611 Description: A vulnerability has been found in the RTSP Live Video Stream Endpoint of the 70mai M300, affecting an unknown functionality of the file /livestream/12. This leads to improper authentication. The attack...

PT-2025-26589 · Unknown · Notepadnext

Name of the Vulnerable Software and Affected Versions: NotepadNext versions through v0.11 Description: The issue is an Out-of-bounds Write vulnerability in dail8859 NotepadNext, affecting the src/lua/src modules, specifically program files ldebug.C and lvm.C. Recommendations: For NotepadNext...

sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow

Withdrawn Advisory This advisory has been withdrawn because the affected code was never included in a release. This link has been maintained to preserve external references. Original Description A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and...