Security Bulletin: XML External Entity (XXE) injection vulnerability affects IBM Business Automation Workflow - CVE-2023-4218

Summary IBM Business Automation Workflow containers package a vulnerable copy of eclipse jars. Vulnerability Details CVEID:CVE-2023-4218 DESCRIPTION: Eclipse IDE could allow a local authenticated attacker to obtain sensitive information, caused by improper handling of XML external entity XXE...

Security Bulletin: Security vulnerability in Apache Kafka clients affects IBM Business Automation Workflow Case Event Emitters - CVE-2024-31141

Summary IBM Business Automation Workflow Case Event Emitters package a vulnerable version of Apache Kafka clients. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION: Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apac...

PT-2025-18938 · Gnu +1 · Gnu Pspp +1

Name of the Vulnerable Software and Affected Versions: GNU PSPP versions through 2.0.1 Description: The issue allows attackers to cause a denial of service, resulting in an application exit, via crafted input data. This can be triggered by specific data that causes a call from the...

PT-2025-18959 · Unknown · Bluewave Checkmate

Name of the Vulnerable Software and Affected Versions: BlueWave Checkmate versions through 2.0.2 before d4a6072 Description: The issue allows an invite request to be modified to specify a privileged role. Recommendations: For BlueWave Checkmate versions through 2.0.2 before d4a6072, consider...

PT-2025-18955 · Unknown · Code-Projects Online Bus Reservation Site

Name of the Vulnerable Software and Affected Versions: code-projects Online Bus Reservation System version 1.0 Description: A critical issue has been found in the system, affecting some unknown functionality of the file /print.php. The manipulation of the ID argument leads to SQL injection. The...

PT-2025-18932 · WordPress · Verticalresponse Newsletter Widget

Name of the Vulnerable Software and Affected Versions: VerticalResponse Newsletter Widget plugin for WordPress versions up to, and including, 1.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'verticalresponse' shortcode due to insufficient input sanitization a...

PT-2025-18928 · WordPress · Personizely

Name of the Vulnerable Software and Affected Versions: Personizely plugin for WordPress versions up to, and including, 0.10 Description: The issue is related to Stored Cross-Site Scripting via the widgetId parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-18936 · WordPress · Database Toolset

Name of the Vulnerable Software and Affected Versions: Database Toolset plugin for WordPress versions up to, and including, 1.8.4 Description: The issue allows unauthenticated attackers to extract sensitive data from database backup files stored in a publicly accessible location. This is possible...

CVE-2025-4215 gorhill uBlock Origin UI 1p-filters.js currentStateChanged redos

A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the file src/js/1p-filters.js of the component UI. The manipulation leads to inefficient regular expression complexity. It is possible to laun...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in DOMPurify

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of DOMPurify Vulnerability Details CVEID:CVE-2024-47875 DESCRIPTION: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerabilit...

Security Bulletin: IBM watsonx Orchestrate with watsonx Assistant Cartridge affected by vulnerability in dompurify

Summary IBM watsonx Orchestrate with watsonx Assistant Cartridge contains a vulnerable version of dompurify Vulnerability Details CVEID:CVE-2024-48910 DESCRIPTION: DOMPurify could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype pollution. By...

PT-2025-18925 · Opengrok · Opengrok

Name of the Vulnerable Software and Affected Versions: OpenGrok version 1.13.25 Description: The issue is a reflected Cross-Site Scripting XSS problem that occurs when the application generates the history view page. This happens due to improper handling of path segments, causing the application ...

PT-2025-18768 · Gosoft · Gosoft Software Proticaret E-Commerce

Name of the Vulnerable Software and Affected Versions: Gosoft Software Proticaret E-Commerce versions prior to 6.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack wher...

PT-2025-18793 · Dassault Systèmes · Solidworks Edrawings

Name of the Vulnerable Software and Affected Versions: SOLIDWORKS eDrawings version 2025 Description: An Out-Of-Bounds Write issue exists in the OBJ file reading procedure. This could allow an attacker to execute arbitrary code when opening a specially crafted OBJ file. Recommendations: For versi...

PT-2025-18914 · Obfstr · Obfstr

Name of the Vulnerable Software and Affected Versions: obfstr crate versions prior to 0.4.4 Description: The issue arises from the obfstr! argument type not being restricted to string slices, resulting in invalid UTF-8 conversion that produces an invalid value. Recommendations: For versions prior...

PT-2025-18772

Name of the Vulnerable Software and Affected Versions SambaBox versions prior to 5.1 Description The issue affects SambaBox due to an improper control of generation of code, allowing code injection. Recommendations For versions prior to 5.1, update to version 5.1 or later to resolve the issue...

PT-2025-18924 · FFmpeg +1 · Ffmpeg +1

Name of the Vulnerable Software and Affected Versions: ffmpeg version 7.1 Description: The issue is related to a Null Pointer Dereference in the iamf read header function located in /libavformat/iamfdec.c. This is a general information about the problem, but specific details about the number of...

PT-2025-18907 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the fixed version Description: The issue is related to an off-by-one fsmap error on 1k block filesystems in the Linux kernel. It occurs when the ioctl function is called with the FS IOC GETFSMAP command, and the...

PT-2025-18729 · Unknown · Phpgurukul Employee Record Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Employee Record Management System version 1.3 Description: A critical vulnerability has been found in the PHPGurukul Employee Record Management System, affecting an unknown functionality of the file /editmyeducation.php. The...

PT-2025-18766 · WordPress · Buddyboss Platform

Name of the Vulnerable Software and Affected Versions: Buddyboss Platform plugin for WordPress versions prior to 2.8.51 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the bp nouveau ajax media save function. This allo...