Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to denial of service and nonstandard cookie parsing due to hbase-client.

Summary hbase-client is used by the ds-cas-lite microservice as part of the Java client API for HBase. Vulnerability Details CVEID:CVE-2023-26048 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by an out of memory flaw in the HttpServletRequest.getParameter or...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to denial of service due to hbase-client

Summary hbase-client is used by the ds-cas-lite microservice as part of the HBase API functionality. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to arbitrary configuration injection due to pip:22.3.1

Summary Pip is used by the DataStage on Cloud Pak for Data px-runtime microservice as part of package installation. Vulnerability Details CVEID:CVE-2023-5752 DESCRIPTION: When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial...

Arbitrary Command Injection

Overview plotai is a Create plots in Python with AI Affected versions of this package are vulnerable to Arbitrary Command Injection in executor.py due to lack of validation of LLM-generated output. An attacker can supply code which will then be executed with Python's exec function. Remediation...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to denial of service due to hbase-client

Summary hbase-client is used by the ds-cas-lite microservice as part of the HBase API functionality. Vulnerability Details CVEID:CVE-2023-52428 DESCRIPTION: Connect2id Nimbus-JOSE-JWT is vulnerable to a denial of service, caused by improper validation of user requests by the PasswordBasedDecrypte...

CVE-2025-26865

Apache OFBiz is vulnerable to Server-Side Template Injection (SSTI) in the FreeMarker template engine due to a regression between versions 18.12.17 and 18.12.18 . Specifically, the vulnerability affects the "ecommerce" plugin , reopening a previously fixed issue (CVE-2022-25813). If successfully ...

PT-2025-10561 · Pagelayer · Pagelayer

Name of the Vulnerable Software and Affected Versions: Pagelayer versions prior to 1.9.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the pagelayer save post function. This allows unauthenticated attackers to modify post contents...

PT-2025-11649 · Kemp · Kemp Loadmaster

Name of the Vulnerable Software and Affected Versions: Progress LoadMaster versions 7.2.40.0 and above ECS versions all versions Multi-Tenancy versions 7.1.35.4 and above Description: The issue is related to an improper input validation vulnerability in Progress LoadMaster, which allows a buffer...

Google Chrome < 134.0.6998.89 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 134.0.6998.89. It is, therefore, affected by a vulnerability as referenced in the 202503stable-channel-update-for-desktop19 advisory. - CVE-2025-2476 is a use after free in Lens. It was reported by SungKwon Lee of Enki...

PT-2025-12414

Name of the Vulnerable Software and Affected Versions Hercules Augeas version 1.14.1 Description A problematic issue has been found, affecting the re case expand function in the src/fa.c file. The manipulation of the re argument leads to a null pointer dereference. Local attacks are required to...

PT-2025-10615 · Locals3 · Locals3

Name of the Vulnerable Software and Affected Versions: LocalS3 versions prior to 1.21 Description: The issue concerns XML External Entity XXE injection in the bucket creation endpoint. When processing the CreateBucketConfiguration XML document, the service's XML parser resolves external entities...

Fedora: Security Advisory (FEDORA-2025-2215919645)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-17274

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc7 Description A vulnerability in the Linux kernel has been resolved, related to the dmaengine and specifically the fsl-edma component. The issue was caused by not freeing the irq correctly in the remove...

PT-2025-16664

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.13.0-rc6+ Description A vulnerability in the Linux kernel has been resolved, related to the management of listener transports in the nfsd module. When no active threads are running, a root user using the nfsdct...

CVE-2025-27636

Apache Camel is vulnerable to a bypass/injection vulnerability in its default incoming header filter. The flaw allows attackers to inject Camel-specific headers using mixed-case strings (e.g., CAmelExecCommandExecutable) that bypass the filter's check for headers starting with "Camel", "camel", o...

PT-2025-10455 · Joomlaux · Joomlaux Jux Real Estate

Name of the Vulnerable Software and Affected Versions: JoomlaUX JUX Real Estate version 3.4.0 Description: A problematic issue was found in the software, affecting an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the...

PT-2025-17240 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.38 Description: An issue in MyBB allows a remote attacker to obtain sensitive information via the Change Avatar function. The supplier disputes this due to the allowed actions of Board administrators and SSRF mitigation...

PT-2025-14357

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the removal of a Hyper-V framebuffer device. When the device is unbound, the hyperv fb driver attempts to release the...

GHSA-FMWF-C46W-R8QM qcp has possible crash/DOS in some build configurations

Nature of issue: Crash Denial of Service Source of issue: Dependent package ring Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affected All versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks. Released qcp...

qcp has possible crash/DOS in some build configurations

Nature of issue: Crash Denial of Service Source of issue: Dependent package ring Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affected All versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks. Released qcp...