PT-2025-4266 · Oracle · Oracle Communications Order/Service Management

Name of the Vulnerable Software and Affected Versions: Oracle Communications Order and Service Management versions 7.4.0 through 7.5.0 Description: The issue is related to improper permission storage in the Oracle Communications Order and Service Management product, allowing a low-privileged...

PT-2025-4274 · Oracle · Jd Edwards Enterpriseone Orchestrator

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Orchestrator versions prior to 9.2.9.2 Description: The issue is related to insufficient input validation in the E1 IOT Orchestrator Security component. It can be easily exploited by a low-privileged attacker with...

PT-2025-4275 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.25 Oracle Database Server versions 21.3 through 21.16 Oracle Database Server versions 23.4 through 23.6 Description: The issue is related to the Java VM component of Oracle Database Server, wher...

PT-2025-1609 · Docker +1 · Docker Compose +1

Name of the Vulnerable Software and Affected Versions: compose-go versions v2.10 through v2.4.0 Docker Compose versions v2.27.0 through v2.29.7 Description: The issue allows an authorized user who sends malicious YAML payloads to cause excessive memory and CPU cycle consumption while parsing YAML...

PT-2025-4268 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server...

[SECURITY] [DLA 4023-1] libebml security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4023-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk January 20, 2025 https://wiki.debian.org/LTS -...

PT-2025-4857 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.10 Description: A SQL Injection vulnerability was identified in the WeGIA application, specifically in the "adicionar cor.php" endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the...

Debian: Security Advisory (DSA-5845-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-3643 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.10.0 Description: A page fault vulnerability has been resolved in the Linux kernel, specifically in the AMD GPU display driver. The issue arose due to a mismatch in the maximum surface definition, where the DC...

PT-2025-3888 · Google +2 · V8 +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 133.0.6943.53 Description: A remote attacker could potentially exploit heap corruption via a crafted HTML page, leveraging a use after free issue in V8. The estimated number of potentially affected devices...

CVE-2025-0557

Hyland Alfresco Community Edition and Alfresco Enterprise Edition up to 6.2.2 are affected by a cross-site scripting issue in the URL Handler component that touches an unknown part of the /share/s/ path. The vulnerability can be exploited remotely, with exploitation information disclosed publicly...

CVE-2025-23207

A flaw was found in the KaTeX library. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript or generate invalid HTML. Mitigation Users unable to upgrade should turn off the trust option or set ...

PT-2025-4606 · Gitoxide · Gitoxide

Name of the Vulnerable Software and Affected Versions: gitoxide versions prior to 0.17.0 Description: The issue arises from the gix-worktree-state specifying 0777 permissions when checking out executable files. This is intended to be restricted by the umask, but one of the strategies used to set...

CVE-2025-23207 \htmlData does not validate attribute names in KaTeX

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade t...

CVE-2025-23206

The CVE-2025-23206 issue affects AWS CDK (IAM OIDC custom resource workflow). The tls.connect call sets rejectUnauthorized: false, enabling potential MITM risk when downloading CA thumbprints. A patch is in progress; remediation guidance in the connected docs recommends upgrading to CDK v2.177.0 ...

OESA-2025-1044 apache-mina security update

Apache MINA is a network application framework which helps users develop high performance and high scalability network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO. Security Fixes: The...

PT-2025-2393 · Etic Telecom · Etic Telecom Remote Access Server

Name of the Vulnerable Software and Affected Versions: ETIC Telecom Remote Access Server RAS versions prior to 4.5.0 Description: The issue concerns reflected cross site scripting XSS attacks. This occurs in the get view method under the view parameter. The ETIC RAS web server uses dynamic pages...

RedShift JDBC Driver < 2.1.0.32 (CVE-2024-12744)

The Amazon Redshift JDBC Driver, version 2.1.0.31, is affected by CVE-2024-12744, a SQL injection issue when utilizing the getschemas, gettables, or getcolumns Metadata APIs. This issue has been addressed in driver version 2.1.0.32. We recommend customers upgrade to the driver version 2.1.0.32 or...

PT-2025-3938 · Unknown · Codezips Gym Management System

Name of the Vulnerable Software and Affected Versions: Codezips Gym Management System version 1.0 Description: A critical issue has been found in the system, allowing for remote SQL injection attacks. The manipulation of the m id argument in the file /dashboard/admin/new submit.php leads to this...

PT-2025-1297 · Katex +3 · Katex +3

Name of the Vulnerable Software and Affected Versions: KaTeX versions prior to 0.16.21 Description: The issue is related to the renderToString function in the KaTeX JavaScript library, which is used for rendering mathematical expressions. It is caused by incorrect encoding or escaping of output...