PT-2025-22341 · WordPress · The Glossary

Name of the Vulnerable Software and Affected Versions: The Glossary by WPPedia – Best Glossary plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to PHP Object Injection via deserialization of untrusted input from the posttypes parameter. This allows...

CVE-2025-5007 Part-DB Profile Picture Feature AttachmentSubmitHandler.php handleUpload cross site scripting

A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file src/Services/Attachments/AttachmentSubmitHandler.php of the component Profile Picture Feature. The manipulation of the argument attachmen...

Improper Neutralization of Escape, Meta, or Control Sequences

Overview Affected versions of this package are vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences via the Hubble CLI terminal output processing. An attacker can manipulate the output to conceal log entries, rewrite output, or make the terminal temporarily unusable by...

DoS (Denial of Service) Third-Party Dependency in Jira Software Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 9.12.0, 10.2.0, 10.3.0, 10.4.0, 10.5.0, and 10.6.0 of Jira Software Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2025-47936

TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, Webhooks are inherently vulnerable to Cross-Site Request Forgery CSRF, which can be exploited by adversaries to target internal resources...

CVE-2025-30193

DNSdist (DNS load balancer) is affected by CVE-2025-30193 due to a vulnerability where unlimited queries on a single TCP connection can exhaust the stack and crash the process, causing DoS. Remediation is to upgrade to version 1.9.10. As a workaround, set a maximum number of TCP queries per conne...

[SECURITY] [DLA 4174-1] openjdk-11 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4174-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort May 20, 2025 https://wiki.debian.org/LTS -...

PT-2025-22301 · Wavlink · Wavlink Wl-Wn579A3

Name of the Vulnerable Software and Affected Versions: Wavlink WL-WN579A3 version 1.0 Description: A command injection vulnerability in the component /cgi-bin/firewall.cgi allows attackers to execute arbitrary commands via a crafted input. This issue affects the /cgi-bin/firewall.cgi endpoint,...

PT-2025-22285 · Unknown +1 · Kubernetes Containerd

Name of the Vulnerable Software and Affected Versions: containerd version 2.1.0 Description: A time-of-check to time-of-use TOCTOU vulnerability was found in containerd. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system...

PT-2025-22125

Name of the Vulnerable Software and Affected Versions: Rapid7 AppSpider Pro versions prior to 7.5.018 Description: The issue is related to a stored cross-site scripting vulnerability in the ScanName field. Although the application prevents the inclusion of special characters within the ScanName...

PT-2025-22281 · Jetbrains · Youtrack +1

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.03.2 Description: The issue allows for stored XSS via YouTrack integration. Recommendations: For versions prior to 2025.03.2, update to version 2025.03.2 or later to resolve the issue...

Atlassian Jira 9.12.x < 9.12.22 (JRASERVER-78717)

The version of Atlassian Jira Server running on the remote host is affected by a vulnerability as referenced in the JRASERVER-78717 advisory. - An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. CVE-2021-33813 Note that Nessu...

PT-2025-22368

Name of the Vulnerable Software and Affected Versions sr feuser register extension for TYPO3 versions through 12.4.8 Description The issue allows remote code execution via unsafe deserialization. There is no information provided about the estimated number of potentially affected devices worldwide...

PT-2025-22119 · Salesforce · Omnis Studio

Name of the Vulnerable Software and Affected Versions: Salesforce OmniStudio versions prior to Spring 2025 Description: The issue concerns the improper preservation of permissions in Salesforce OmniStudio FlexCards, allowing the bypass of field-level security controls for OmniUICard objects...

PT-2025-22121 · Salesforce · Omnis Studio

Name of the Vulnerable Software and Affected Versions: Salesforce OmniStudio versions prior to 254 Description: The issue is related to an Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards, which allows exposure of Custom Settings data. Recommendations: For...

PT-2025-22120 · Salesforce · Omnis Studio

Name of the Vulnerable Software and Affected Versions: Salesforce OmniStudio versions prior to Spring 2025 Description: The issue is related to an Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards, which allows exposure of encrypted data. Recommendations: For...

PT-2025-22150 · Schweitzer Engineering Laboratories · Sel-5056 Software-Defined Network Flow Controller

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue allows password guessing limits to be bypassed when using LDAP authentication. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

VMware Workstation 17.0.x < 17.6.3 Multiple Vulnerabilities (VMSA-2025-0010)

The version of VMware Workstation installed on the remote host is 17.0.x prior to 17.6.3. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

PT-2025-22371

Name of the Vulnerable Software and Affected Versions femanager extension versions prior to 8.2.2 Description The issue allows attackers to view frontend user data. This is achieved through an Insecure Direct Object Reference IDOR in the femanager TYPO3 extension, where attackers can exploit a us...

PT-2025-23038

Name of the Vulnerable Software and Affected Versions GNU Coreutils affected versions not specified Description A flaw was found in the sort utility's begfield function, which is vulnerable to a heap buffer under-read. This issue may cause the program to access memory outside the allocated buffer...