CVE-2025-3016

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument...

[SECURITY] [DLA 4110-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4110-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort April 02, 2025 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 4109-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4109-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort April 02, 2025 https://wiki.debian.org/LTS -...

CVE-2025-3019

KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java Script may be executed with this user's permissions. This can lead to information loss and/or modification of existin...

PT-2025-14541 · Os4Ed · Os4Ed Opensis

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS versions 8.0 through 9.1 Description: An issue in OS4ED openSIS allows attackers to execute a directory traversal and delete files by sending a crafted POST request. The attack targets the...

PT-2025-16717

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been identified, related to the SMB client. The issue arises from an imbalance in the netns reference count, leading to potential leaks and...

PT-2025-14518 · Jenkins · Jenkins Asakusasatellite Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins AsakusaSatellite Plugin versions 0.1.1 and earlier Description: The issue concerns the exposure of AsakusaSatellite API keys on the job configuration form, which could allow attackers to observe and capture them. Recommendations: For...

PT-2025-14499 · Stmicroelectronics · X-Cube-Azrtos-Wl

Name of the Vulnerable Software and Affected Versions: STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0 Description: A buffer overflow issue exists in the FileX Internal RAM interface functionality, allowing code execution through specially crafted network packets. An attacker can trigger this...

PT-2025-14550

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.6.1 through 2.6.13 Description The issue allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase when OpenVPN is used in server mode with TLS-crypt-v2. ...

PT-2025-14448 · Dell · Dell Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions prior to 5.1 Description: The issue is related to Insecure Inherited Permissions, which could be exploited by a low-privileged attacker with local access, potentially leading to unauthorized access...

PT-2025-14551 · Arduino · Arduino Ide

Name of the Vulnerable Software and Affected Versions: Arduino IDE versions prior to 2.3.5 Description: A Self Cross-Site Scripting XSS vulnerability has been identified in the Arduino IDE. The vulnerability occurs in the Additional Board Manager URLs field, which can be found in the Preferences ...

PT-2025-14444 · Dell · Dell Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions prior to WMS 5.1 Description: The issue concerns an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability,...

PT-2025-14447 · Dell · Dell Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions prior to 5.1 Description: The issue allows an unauthenticated attacker with remote access to potentially exploit the vulnerability, leading to information disclosure. This is due to an Exposure of Sensitive...

PT-2025-14467 · Ros +1 · Ros +1

Name of the Vulnerable Software and Affected Versions: Robot Operating System ROS versions Noetic and earlier Description: A YAML deserialization vulnerability was found in the ROS 'dynparam' command-line tool, affecting the ability to get, set, and delete parameters of a dynamically configurable...

PT-2025-27525

Name of the Vulnerable Software and Affected Versions: llama index version 0.12.27 Description: A flaw in the ObsidianReader class allows for hardlink-based path traversal, enabling attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting...

PT-2025-14556 · Tauri · Tauri Shell Plugin

Name of the Vulnerable Software and Affected Versions: Tauri shell plugin versions prior to 2.2.1 Description: The Tauri shell plugin exposes functionality to execute code and open programs on the system. Due to improper validation of allowed protocols, potentially dangerous protocols like file:/...

PT-2025-14533 · Trend Micro · Trend Vision One

Name of the Vulnerable Software and Affected Versions: Trend Vision One affected versions not specified Description: A broken access control issue in the Trend Vision One User Account component could have allowed an administrator to create users who could then change the role of the account and...

PT-2025-14545 · Bl-Ac2100 · Bl-Ac2100

Name of the Vulnerable Software and Affected Versions: BL-AC2100 versions 1.0.4 and earlier Description: The issue allows a remote attacker to execute arbitrary code via the enable parameter passed to "/goform/set hidessid cfg", which is not handled properly. Recommendations: For BL-AC2100 versio...

PT-2025-14565 · Wondercms · Wondercms

Name of the Vulnerable Software and Affected Versions: WonderCMS version 3.5.0 Description: A critical vulnerability has been found in WonderCMS, affecting the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload...

XXE (XML External Entity Injection) in Jira Core Data Center and Server and Jira Software Server

This High severity XXE XML External Entity Injection vulnerability was introduced in version 9.12.0 of Jira Core Data Center and Server and Jira Software Server. This XXE XML External Entity Injection vulnerability, with a CVSS Score of 7.7, allows an attacker to access local and remote content...