PT-2025-1573

Name of the Vulnerable Software and Affected Versions NVIDIA GPU display driver for Windows and Linux versions are affected, but specific versions are not provided in the available data. Description The issue involves data being written past the end or before the beginning of a buffer, which coul...

PT-2025-5046 · Unknown · Raymonddesign Post & Page Notes

Name of the Vulnerable Software and Affected Versions: RaymondDesign Post & Page Notes versions 0.1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

GHSA-MM6V-68QP-F9FW Crayfish allows Remote Code Execution via Homarus Authorization header

Impact Remote code execution may be possible in web-accessible installations of Homarus in certain configurations. Patches The issue has been patched in islandora/crayfish:4.1.0 Workarounds The exploit requires making a request against the Homarus's /convert endpoint; therefore, the ability to...

GLSA-202501-01 : rsync: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202501-01 rsync: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in rsync. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly from...

PT-2025-3920 · Fanli2012 · Native-Php-Cms

Name of the Vulnerable Software and Affected Versions: Fanli2012 native-php-cms version 1.0 Description: A critical issue has been found in the processing of the file /fladmin/article dodel.php. The manipulation of the id argument leads to SQL injection. The attack may be initiated remotely. The...

CVE-2024-55924

CVE-2024-55924 affects TYPO3, specifically the Scheduler Module, where back-end deep-link functionality is vulnerable to CSRF and state-changing actions were accepting HTTP GET submissions. Exploitation requires an active backend session and social-engineering the user into visiting a malicious U...

K000149289: Apache Traffic Control vulnerability CVE-2024-45387

Security Advisory Description An SQL injection vulnerability in Traffic Ops in Apache Traffic Control = 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request...

CVE-2024-45627 Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability

In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be...

CVE-2024-45627 Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability

In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be...

CVE-2024-45627 Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability

In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be...

January 14, 2025—KB5050061 (Security-only update)

None None...

January 14, 2025—KB5050063 (Monthly Rollup)

None None...

PT-2025-1279 · Adobe · Substance3D - Stager

Name of the Vulnerable Software and Affected Versions: Substance3D - Stager versions 3.0.4 and earlier Description: The issue is related to a stack-based buffer overflow that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...

PT-2025-2747 · Fortinet · Fortisiem

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSIEM versions 5.3 through 7.1.5 Description: A resource allocation issue without limits or throttling may allow an attacker to deny valid TLS traffic by consuming all allotted connections. Recommendations: For Fortinet FortiSIEM...

PT-2025-1152 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue affects Microsoft Windows, specifically the Windows Reliable Multicast Transport Driver RMCAST, allowing remote attackers to execute arbitrary code and impact the system...

PT-2025-4760 · Linksys · Linksys E5600 Router

Name of the Vulnerable Software and Affected Versions: Linksys E5600 Router version 1.1.0.26 Description: A stored cross-site scripting XSS vulnerability in the spf table content component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc...

PT-2025-1267 · Microsoft +5 · Edge +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 132.0.6834.83 Microsoft Edge affected versions not specified Description: The issue is related to an out of bounds read in the Metrics component, which could allow a remote attacker to potentially exploit heap...

PT-2025-1285 · Microsoft +5 · Edge +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 132.0.6834.83 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in Compositing, allowing a remote attacker to perform UI spoofing via a crafted...

KB5050681: Servicing stack update for Windows Server 2008 R2 SP1: January 14, 2025

None None...

PT-2025-1281 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 132.0.6834.83 Description: The issue is related to an inappropriate implementation in Fullscreen mode, allowing a remote attacker to perform UI spoofing via a crafted HTML page. This could enable the attacker t...