Fedora: Security Advisory (FEDORA-2025-59ebc165fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Vulnerability in commons-compress affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-25710, CVE-2024-26308].

Summary The commons-compress package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-25710, CVE-2024-26308. Vulnerability Details CVEID:CVE-2024-25710 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop'...

Security Bulletin: XML External Entity (XXE) injection vulnerability affects IBM Business Automation Workflow - CVE-2023-4218

Summary IBM Business Automation Workflow containers package a vulnerable copy of eclipse jars. Vulnerability Details CVEID:CVE-2023-4218 DESCRIPTION: Eclipse IDE could allow a local authenticated attacker to obtain sensitive information, caused by improper handling of XML external entity XXE...

Security Bulletin: Security vulnerability in Apache Kafka clients affects IBM Business Automation Workflow Case Event Emitters - CVE-2024-31141

Summary IBM Business Automation Workflow Case Event Emitters package a vulnerable version of Apache Kafka clients. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION: Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apac...

PT-2025-18936 · WordPress · Database Toolset

Name of the Vulnerable Software and Affected Versions: Database Toolset plugin for WordPress versions up to, and including, 1.8.4 Description: The issue allows unauthenticated attackers to extract sensitive data from database backup files stored in a publicly accessible location. This is possible...

PT-2025-18938 · Gnu +1 · Gnu Pspp +1

Name of the Vulnerable Software and Affected Versions: GNU PSPP versions through 2.0.1 Description: The issue allows attackers to cause a denial of service, resulting in an application exit, via crafted input data. This can be triggered by specific data that causes a call from the...

PT-2025-18955 · Unknown · Code-Projects Online Bus Reservation Site

Name of the Vulnerable Software and Affected Versions: code-projects Online Bus Reservation System version 1.0 Description: A critical issue has been found in the system, affecting some unknown functionality of the file /print.php. The manipulation of the ID argument leads to SQL injection. The...

PT-2025-18928 · WordPress · Personizely

Name of the Vulnerable Software and Affected Versions: Personizely plugin for WordPress versions up to, and including, 0.10 Description: The issue is related to Stored Cross-Site Scripting via the widgetId parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-18959 · Unknown · Bluewave Checkmate

Name of the Vulnerable Software and Affected Versions: BlueWave Checkmate versions through 2.0.2 before d4a6072 Description: The issue allows an invite request to be modified to specify a privileged role. Recommendations: For BlueWave Checkmate versions through 2.0.2 before d4a6072, consider...

PT-2025-18932 · WordPress · Verticalresponse Newsletter Widget

Name of the Vulnerable Software and Affected Versions: VerticalResponse Newsletter Widget plugin for WordPress versions up to, and including, 1.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'verticalresponse' shortcode due to insufficient input sanitization a...

CVE-2025-4215 gorhill uBlock Origin UI 1p-filters.js currentStateChanged redos

A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the file src/js/1p-filters.js of the component UI. The manipulation leads to inefficient regular expression complexity. It is possible to laun...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in DOMPurify

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of DOMPurify Vulnerability Details CVEID:CVE-2024-47875 DESCRIPTION: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerabilit...

Security Bulletin: IBM watsonx Orchestrate with watsonx Assistant Cartridge affected by vulnerability in dompurify

Summary IBM watsonx Orchestrate with watsonx Assistant Cartridge contains a vulnerable version of dompurify Vulnerability Details CVEID:CVE-2024-48910 DESCRIPTION: DOMPurify could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype pollution. By...

PT-2025-18925 · Opengrok · Opengrok

Name of the Vulnerable Software and Affected Versions: OpenGrok version 1.13.25 Description: The issue is a reflected Cross-Site Scripting XSS problem that occurs when the application generates the history view page. This happens due to improper handling of path segments, causing the application ...

PT-2025-18907

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the fixed version Description The issue is related to an off-by-one fsmap error on 1k block filesystems in the Linux kernel. It occurs when the ioctl function is called with the FS IOC GETFSMAP command, and the f...

PT-2025-18911 · Vercel +1 · @Vercel/Flags +1

Name of the Vulnerable Software and Affected Versions: Flags versions 3.2.0 and prior @vercel/flags versions 3.1.1 and prior Description: The issue allows for information disclosure, where a bad actor could gain access to a list of all feature flags exposed through the "flags discovery endpoint"...

PT-2025-18755 · WordPress · Homey

Name of the Vulnerable Software and Affected Versions: Homey theme for WordPress versions prior to 2.4.5 Description: The issue allows authenticated attackers with Subscriber-level access and above to delete arbitrary reservations and posts due to a missing capability check on the homey reservati...

PT-2025-18924 · FFmpeg +1 · Ffmpeg +1

Name of the Vulnerable Software and Affected Versions: ffmpeg version 7.1 Description: The issue is related to a Null Pointer Dereference in the iamf read header function located in /libavformat/iamfdec.c. This is a general information about the problem, but specific details about the number of...

PT-2025-18914 · Obfstr · Obfstr

Name of the Vulnerable Software and Affected Versions: obfstr crate versions prior to 0.4.4 Description: The issue arises from the obfstr! argument type not being restricted to string slices, resulting in invalid UTF-8 conversion that produces an invalid value. Recommendations: For versions prior...

PT-2025-18792 · Apache · Apache Parquet Java

Name of the Vulnerable Software and Affected Versions: Apache Parquet versions prior to 1.15.2 Description: The vulnerability in Apache Parquet Java allows remote code execution via insecure parquet-avro module schema parsing. The issue affects versions up to 1.15.1. The parquet-avro module is...