PT-2025-17423 · Libheif +1 · Libheif +1

Name of the Vulnerable Software and Affected Versions: libheif versions prior to 1.19.6 Description: The issue is caused by a NULL pointer dereference in ImageItem Grid::get decoder in image-items/grid.cc, which occurs when a grid image references a nonexistent image item. Recommendations: For...

PT-2025-08: Deserialization of untrusted data in TCPDF

This library has a class containing a POP Property Oriented Programming chain. When deserializing this class with certain values ​​of some fields, an attacker can delete an arbitrary file from the system. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 20.04.2025...

PT-2025-17415

Name of the Vulnerable Software and Affected Versions Convertigo versions 8.3.4 and earlier Description The issue is related to the TwsCachedXPathAPI in Convertigo, which does not restrict the use of commons-jxpath APIs. Recommendations For versions 8.3.4 and earlier, consider restricting access ...

PT-2025-22357

Name of the Vulnerable Software and Affected Versions FW-WGS-804HPT version 1.305b241111 Description A stack overflow issue was discovered through the ownekey parameter in the web rmon alarm post rmon alarm function. This issue allows for potential exploitation. Recommendations For FW-WGS-804HPT...

PT-2025-22304 · Unknown · Fw-Wgs-804Hpt

Name of the Vulnerable Software and Affected Versions: FW-WGS-804HPT version 1.305b241111 Description: A stack overflow issue was discovered via the radDftParamKey parameter in the web radiusSrv dftParam post function. Recommendations: For FW-WGS-804HPT version 1.305b241111, consider disabling th...

PT-2025-17399 · Unknown · Gnu Mailman

Name of the Vulnerable Software and Affected Versions: GNU Mailman version 2.1.39 Description: GNU Mailman 2.1.39, as bundled in cPanel and WHM, allows unauthenticated attackers to create lists via the "/mailman/create" endpoint. Recommendations: For GNU Mailman version 2.1.39, consider disabling...

PT-2025-17398 · Unknown · Gnu Mailman

Name of the Vulnerable Software and Affected Versions: GNU Mailman version 2.1.39 Description: The issue allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. This occurs in certain external archiver configurations. Recommendations: F...

PT-2025-17400 · Infodraw · Infodraw Media Relay Service

Name of the Vulnerable Software and Affected Versions: Infodraw Media Relay Service version 7.1.0.0 Description: The issue allows reading arbitrary files via ../ directory traversal in the username field. This can potentially reveal administrator credentials in cleartext or with MD5 hashing when...

PT-2025-17413 · Unknown · Wing Ftp Server

Name of the Vulnerable Software and Affected Versions: Wing FTP Server versions prior to 7.4.4 Description: Wing FTP Server does not properly validate and sanitize the url parameter of the /downloadpass.html API endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link,...

PT-2025-17424 · Gobgp +4 · Gobgp +4

Name of the Vulnerable Software and Affected Versions: GoBGP versions prior to 3.35.0 Description: The issue arises from improper input length checking in the pkg/packet/mrt/mrt.go file, specifically failing to ensure the presence of 12 bytes or 36 bytes depending on the address family...

PT-2025-17425 · Gobgp +4 · Gobgp +4

Name of the Vulnerable Software and Affected Versions: GoBGP versions prior to 3.35.0 Description: An issue was discovered that allows attackers to cause a panic via a zero value for softwareVersionLen. Recommendations: For versions prior to 3.35.0, update to version 3.35.0 or later to resolve th...

PT-2025-17426 · Gobgp +4 · Gobgp +4

Name of the Vulnerable Software and Affected Versions: GoBGP versions prior to 3.35.0 Description: An issue was discovered that allows an attacker to cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context. Recommendations: For versions prior...

PT-2025-17370 · WordPress · Download Manager

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to, and including, 3.3.12 Description: The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function...

PT-2025-17396 · Ssl.Com · Ssl.Com

Name of the Vulnerable Software and Affected Versions: SSL.com versions prior to 2025-04-19 Description: The issue arises when domain validation method 3.2.2.4.14 is used, allowing a trusted TLS certificate to be issued for the domain name of a requester's email address, even if the requester doe...

PT-2025-17366 · Apache · Apache Struts

Name of the Vulnerable Software and Affected Versions: Apache Struts affected versions not specified Description: The issue concerns a command injection problem. No specific details about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was...

PT-2025-17392 · 7 Zip +3 · 7-Zip +2

Name of the Vulnerable Software and Affected Versions: 7-Zip versions 22.01 through 24.09 Description: The issue involves 7-Zip not reporting an error for certain invalid xz files, specifically those with issues related to block flags and reserved bits. Recommendations: For versions 22.01 through...

[SECURITY] [DLA 4130-1] shadow security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4130-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler April 18, 2025 https://wiki.debian.org/LTS -...

CVE-2025-29953 Apache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass

Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client. This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious...

PT-2025-17308 · Unknown · Namelessmc

Name of the Vulnerable Software and Affected Versions: NamelessMC versions 2.1.4 and prior Description: The issue concerns a lack of length validation for the s parameter in GET requests for the forum search functionality, allowing attackers to submit excessively long search queries. This can lea...

PT-2025-17326 · Worldcast Systems · Worldcast Systems Ecreso Fm/Dab/Tv Transmitter

Name of the Vulnerable Software and Affected Versions: WorldCast Systems ECRESO FM/DAB/TV Transmitter version 1.10.1 Description: The issue allows authenticated attackers to escalate privileges via a crafted JSON payload. Recommendations: For WorldCast Systems ECRESO FM/DAB/TV Transmitter version...