CVE-2024-27137

In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these...

CVE-2024-27137 Apache Cassandra: unrestricted deserialization of JMX authentication credentials

In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these...

AZL-56436 CVE-2025-23015 affecting package cassandra 5.0.0-2

Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on...

PT-2025-2200 · WordPress · B Slider- Gutenberg Slider Block

Name of the Vulnerable Software and Affected Versions: The B Slider- Gutenberg Slider Block for WP plugin for WordPress versions up to, and including, 1.9.5 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from private posts they should...

PT-2025-2644 · Ibm · Ibm Security Verify Access Appliance +1

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access Appliance and Container versions 10.0.0 through 10.0.8 Description: The issue involves the transmission of sensitive or security-critical data in cleartext in a communication channel that can be detected by...

PT-2025-5611 · Rengine · Rengine

Name of the Vulnerable Software and Affected Versions: reNgine versions up to and including 2.20 Description: An unrestricted project deletion vulnerability in reNgine allows attackers with specific roles, such as penetration tester or auditor, to delete all projects in the system. This can lead ...

PT-2025-4176 · Samsung · Samsung Email

Name of the Vulnerable Software and Affected Versions: Samsung Email versions prior to 6.1.97.1 Description: The issue is related to improper access control, allowing physical attackers to access data across multiple user profiles. Recommendations: For versions prior to 6.1.97.1, update to versio...

PT-2025-4133

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 135 Thunderbird versions prior to 135 Description Memory safety bugs are present in Firefox and Thunderbird, with evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be...

PT-2025-2248 · WordPress · Qi Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Qi Addons For Elementor versions 1.8.7 and earlier Description: The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cursor parameter due to insufficient input sanitization and output escaping...

PT-2025-2114

Name of the Vulnerable Software and Affected Versions Giga Messenger WordPress plugin versions 2.3.1 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the page. This coul...

PT-2025-4388 · Joomla · Sourcerer

Name of the Vulnerable Software and Affected Versions: Sourcerer extension for Joomla versions prior to 11.0.0 Description: The issue arises from improper control of code generation in the Sourcerer extension for Joomla, leading to a remote code execution vulnerability. Recommendations: For...

PT-2025-4126 · Mozilla +10 · Thunderbird +12

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 135 Firefox ESR versions prior to 128.7 Thunderbird versions prior to 128.7 Thunderbird versions prior to 135 Description: A race condition could have led to private browsing tabs being opened in normal browsing...

PT-2025-4128 · Mozilla +8 · Thunderbird +8

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 128.7 Description: The Thunderbird Address Book URI fields contained unsanitized links, which could be used by an attacker to create and export an address book containing a malicious payload in a field, such as t...

PT-2025-4613 · Sendpulse · Sendpulse Email Marketing Newsletter

Name of the Vulnerable Software and Affected Versions: SendPulse Email Marketing Newsletter versions prior to 2.1.5 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can...

Important: amazon-ssm-agent

Issue Overview: go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags...

PT-2025-5610 · Rengine · Rengine

Name of the Vulnerable Software and Affected Versions: reNgine versions prior to 2.20 Description: A stored cross-site scripting XSS issue exists in the admin panel's user management functionality, allowing an attacker to inject malicious payloads into the username field during user creation. Thi...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2025-2739)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.1611.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2739 advisory. go-git is a highly extensible git implementation library written in pure Go. An argument injection...

CVE-2025-24371

CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the blocksync protocol peers send their base and latest heights when they connect to a new node A, which is syncing to the tip of a network. base acts as a lower ground and informs A that the...

CVE-2025-24899

reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where an insider attacker with any role such as Auditor, Penetration Tester, or Sys Admin can extract sensitive information from other reNgine users. After running a scan and obtainin...

[SECURITY] [DSA 5857-1] openjdk-17 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5857-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 03, 2025 https://www.debian.org/security/faq -...