PT-2025-20398

Name of the Vulnerable Software and Affected Versions Rack::Session versions 2.0.0 through 2.1.0 Description The issue concerns the Rack::Session::Pool middleware, where simultaneous requests can restore a deleted session, allowing an unauthenticated user to occupy that session. If an attacker ca...

PT-2025-20370 · Danfoss · Danfoss Ak-Sm 8Xxa Series

Name of the Vulnerable Software and Affected Versions: Danfoss AK-SM 8xxA Series versions prior to 4.2 Description: The issue is related to an improper authentication vulnerability in the Danfoss AKSM8xxA Series. This vulnerability affects the Danfoss AK-SM 8xxA Series prior to version 4.2...

PT-2025-20350 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, which was caused by a code path in dequeue entities that could set the slice of a sched entity to U64 MAX, resulting in a crash...

PT-2025-20396 · Alfa · Alfa Aip-W512

Name of the Vulnerable Software and Affected Versions: ALFA AIP-W512 version 3.2.2.2.3 Description: The issue is related to an authenticated stack overflow that can be triggered via the targetAPMac parameter in the formWsc function. Recommendations: For ALFA AIP-W512 version 3.2.2.2.3, consider...

PT-2025-20387 · Slims · Slims

Name of the Vulnerable Software and Affected Versions: Slims Senayan Library Management Systems version 9.6.1 Description: The issue is related to SQL Injection in the admin/modules/master file/author.php file. This allows for potential exploitation. No information is provided about the estimated...

Debian dla-4157 : request-tracker4 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4157 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4157-1 [email protected]...

PT-2025-20354 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability has been identified in the Linux kernel, specifically in the nvmet component. The issue arises when attempting to enable a port without a configured transport, causing ...

Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service DoS by depleting process memor...

CVE-2025-27533 Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service DoS by depleting process memor...

DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency in Confluence Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to...

PT-2025-20184 · Ablocks · Ablocks

Name of the Vulnerable Software and Affected Versions: aBlocks versions 1.9.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

PT-2025-20031 · Unknown · Boinc Server

Name of the Vulnerable Software and Affected Versions: BOINC Server versions through 1.4.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in BOINC Server. Recommendations: For BOI...

PT-2025-20285 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions up to and including 3.3.0 Description: An unauthenticated SQL Injection issue was identified in the endpoint "/html/socio/sistema/get socios.php", specifically in the query parameter. This allows attackers to inject and execute...

PT-2025-20057 · Samsung · Samsung Flow

Name of the Vulnerable Software and Affected Versions: Samsung Flow versions prior to 4.9.17.6 Description: The issue is related to improper verification of intent by a broadcast receiver, allowing local attackers to modify the configuration. This could potentially lead to unauthorized changes in...

PT-2025-20219 · Unknown · Credova Financial

Name of the Vulnerable Software and Affected Versions: Credova Financial versions n/a through 2.5.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions n/a through 2.5.0, update to a version that include...

PT-2025-20085 · Unknown · Meow Gallery

Name of the Vulnerable Software and Affected Versions: Meow Gallery versions through 5.2.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject maliciou...

PT-2025-20118 · Unknown · Ultimate Blocks

Name of the Vulnerable Software and Affected Versions: Ultimate Blocks versions n/a through 3.2.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for DOM-Based XSS attacks. Recommendations: For...

PT-2025-20050 · Samsung · Bixby

Name of the Vulnerable Software and Affected Versions: Bixby versions prior to 2.3.74.8 Description: The issue is related to the improper handling of insufficient permission in Bixby wakeup, allowing local attackers to access sensitive data. Recommendations: For versions prior to 2.3.74.8, update...

PT-2025-20225 · Unknown · Wp Maintenance

Name of the Vulnerable Software and Affected Versions: WP Maintenance versions through 6.1.9.7 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions through 6.1.9.7, update to a version that contains a fix for this...

PT-2025-20035 · WordPress · Wz Followed Posts

Name of the Vulnerable Software and Affected Versions: WZ Followed Posts – Display what visitors are reading plugin for WordPress versions up to and including 3.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode due to insufficient input...