PT-2025-4292

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions prior to 7.0.24 Oracle VM VirtualBox versions prior to 7.1.6 Description The issue allows a high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM...

PT-2025-4266 · Oracle · Oracle Communications Order/Service Management

Name of the Vulnerable Software and Affected Versions: Oracle Communications Order and Service Management versions 7.4.0 through 7.5.0 Description: The issue is related to improper permission storage in the Oracle Communications Order and Service Management product, allowing a low-privileged...

PT-2025-3072

Name of the Vulnerable Software and Affected Versions SpagoBI version 3.5.1 Description A Cross-Site Request Forgery CSRF issue has been found in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in,...

PT-2025-1257 · Oracle · Oracle Agile Plm Framework

Name of the Vulnerable Software and Affected Versions: Oracle Agile PLM Framework version 9.3.6 Description: The issue is related to insufficient input validation in the Agile Integration Services component, allowing a low-privileged attacker with network access via HTTP to compromise the Oracle...

PT-2025-4268 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server...

YSA 2025 01 | Yubico

Yubico’s open source pam-u2f software package implements a Pluggable Authentication Module PAM that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue which allows for an authentication bypass in...

[SECURITY] [DLA 4023-1] libebml security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4023-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk January 20, 2025 https://wiki.debian.org/LTS -...

Debian: Security Advisory (DSA-5845-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-4857 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.10 Description: A SQL Injection vulnerability was identified in the WeGIA application, specifically in the "adicionar cor.php" endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the...

PT-2025-3888 · Google +2 · V8 +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 133.0.6943.53 Description: A remote attacker could potentially exploit heap corruption via a crafted HTML page, leveraging a use after free issue in V8. The estimated number of potentially affected devices...

PT-2025-3643 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.10.0 Description: A page fault vulnerability has been resolved in the Linux kernel, specifically in the AMD GPU display driver. The issue arose due to a mismatch in the maximum surface definition, where the DC...

CVE-2025-0557

Hyland Alfresco Community Edition and Alfresco Enterprise Edition up to 6.2.2 are affected by a cross-site scripting issue in the URL Handler component that touches an unknown part of the /share/s/ path. The vulnerability can be exploited remotely, with exploitation information disclosed publicly...

CVE-2025-23207

A flaw was found in the KaTeX library. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript or generate invalid HTML. Mitigation Users unable to upgrade should turn off the trust option or set ...

PT-2025-4606

Name of the Vulnerable Software and Affected Versions gitoxide versions prior to 0.17.0 Description The issue arises from the gix-worktree-state specifying 0777 permissions when checking out executable files. This is intended to be restricted by the umask, but one of the strategies used to set...

CVE-2025-23207 \htmlData does not validate attribute names in KaTeX

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade t...

CVE-2025-23206

The CVE-2025-23206 issue affects AWS CDK (IAM OIDC custom resource workflow). The tls.connect call sets rejectUnauthorized: false, enabling potential MITM risk when downloading CA thumbprints. A patch is in progress; remediation guidance in the connected docs recommends upgrading to CDK v2.177.0 ...

OESA-2025-1044 apache-mina security update

Apache MINA is a network application framework which helps users develop high performance and high scalability network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO. Security Fixes: The...

PT-2025-1297

Name of the Vulnerable Software and Affected Versions KaTeX versions prior to 0.16.21 Description The issue is related to the renderToString function in the KaTeX JavaScript library, which is used for rendering mathematical expressions. It is caused by incorrect encoding or escaping of output whe...

RedShift JDBC Driver < 2.1.0.32 (CVE-2024-12744)

The Amazon Redshift JDBC Driver, version 2.1.0.31, is affected by CVE-2024-12744, a SQL injection issue when utilizing the getschemas, gettables, or getcolumns Metadata APIs. This issue has been addressed in driver version 2.1.0.32. We recommend customers upgrade to the driver version 2.1.0.32 or...

PT-2025-8858

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A crash issue has been identified in the Linux kernel related to the synaptics input driver. When enabling a pass-through port, an interrupt may occur before the psmouse driver binds to...