Security Bulletin: IBM DataStage on Cloud Pak for Data is vulnerable to sensitive information leaks due to a flaw in the Kubernetes kube-apiserver (CVE-2019-11250, CVE-2020-8565)

Summary Kubernetes is used by IBM DataStage on Cloud Pak for Data as part of the container environment. Vulnerability Details CVEID:CVE-2019-11250 DESCRIPTION: Kubernetes could allow a local authenticated attacker to obtain sensitive information, caused by storing credentials in the log by the...

Security Bulletin: IBM DataStage on Cloud Pak for Data is vulnerable to a symlink vulnerability due to Libcontainer and Docker Engine (CVE-2015-3627)

Summary Libcontainer and Docker Engine are used by IBM DataStage on Cloud Pak for Data as part of the container environment. Vulnerability Details CVEID:CVE-2015-3627 DESCRIPTION: A symlink vulnerability in Libcontainer and Docker Engine regarding the file-descriptor being opened prior to...

Security Bulletin: IBM DataStage on Cloud Pak for Data is vulnerable to unlimited data accumulation due to the Netty package ( CVE-2024-29025)

Summary Netty is used by IBM DataStage on Cloud Pak for Data as part of server processing. Vulnerability Details CVEID:CVE-2024-29025 DESCRIPTION: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients...

PT-2025-11189 · Modx · Modx

Name of the Vulnerable Software and Affected Versions: MODX versions prior to 3.1.0 Description: A cross-site scripting XSS issue has been identified. The issue allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...

PHP 8.1.x < 8.1.32 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.1.32. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.32 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

PT-2025-11142 · WordPress · Apppresser

Name of the Vulnerable Software and Affected Versions: AppPresser – Mobile App Framework plugin for WordPress versions up to, and including, 4.4.10 Description: The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title parameter due to...

PT-2025-11185 · Celk Sistemas · Celk Saude

Name of the Vulnerable Software and Affected Versions: Celk Sistemas Celk Saude version 3.1.252.1 Description: The issue concerns user enumeration via discrepancies in error messages in the password recovery functionality, allowing a remote attacker to enumerate users through different responses...

PT-2025-11216 · Microsoft · Dataverse

Name of the Vulnerable Software and Affected Versions: Microsoft Dataverse affected versions not specified Description: Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Recommendations: At the moment, there is no information about ...

PT-2025-11211 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.6 Description: DataEase is an open source business intelligence and data visualization tool. A patch bypass issue allows authenticated users to read and deserialize arbitrary files through the background JDBC...

IBM MQ DoS (7184322)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7184322 advisory. - IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditions...

Security Bulletin: Vulnerability in elasticsearch affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.

Summary Potential vulnerability in elasticsearch has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. The vulnerability have been addressed. Refer to details for additional information...

CVE-2025-27017

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials...

CVE-2025-27017

CVE-2025-27017 affects Apache NiFi releases 1.13.0 through 2.2.0, where the MongoDB authentication credentials (username/password) used by MongoDB components can be included in provenance event records. An authorized user with read access to these provenance events may view the credentials, expos...

CVE-2025-29891 Apache Camel: Camel Message Header Injection through request parameters

Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is...

Security Bulletin: IBM App Connect Enterprise Certified Container is vulnerable to an attacker with deploy privilege [CVE-2025-0799]

Summary IBM App Connect Enterprise Certified Container is vulnerable to an attacker with deploy privilege. Malicious bar files could allow an attacker with deploy privilege to write arbitrary files in the container for a running IBM App Connect Enterprise Certified Container IntegrationRuntime or...

PT-2025-11105 · Softether · Softether Vpn

Name of the Vulnerable Software and Affected Versions: SoftEther VPN version 5.02.5187 Description: The issue is related to a Buffer Overflow in the Internat.c file via the UniToStrForSingleChars function. Recommendations: For SoftEther VPN version 5.02.5187, consider disabling the...

PT-2025-10999 · WordPress · The Finale Lite – Sales Countdown Timer & Discount

Name of the Vulnerable Software and Affected Versions: The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress versions up to, and including, 2.19.0 Description: The issue is related to Stored DOM-Based Cross-Site Scripting via the countdown timer due to insufficie...

PT-2025-11046

Name of the Vulnerable Software and Affected Versions Juniper Junos OS versions prior to 21.2R3-S9 Juniper Junos OS versions 21.4 before 21.4R3-S10 Juniper Junos OS versions 22.2 before 22.2R3-S6 Juniper Junos OS versions 22.4 before 22.4R3-S6 Juniper Junos OS versions 23.2 before 23.2R2-S3 Junip...

Security Bulletin: Vulnerability in TensorFlow affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.

Summary Potential vulnerability in TensorFlow has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.. The vulnerability have been addressed. Refer to details for additional information...

CVE-2025-2177 libzvbi search.c vbi_search_new integer overflow

A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbisearchnew of the file src/search.c. The manipulation of the argument patlen leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the...