PT-2025-8796

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been identified, specifically in the powerpc/pseries/iommu component. The issue arises when a user attempts to use the same vfio container used by...

PT-2025-1898 · Icegram Express · Email Subscribers By Icegram Express

Name of the Vulnerable Software and Affected Versions: Email Subscribers by Icegram Express versions prior to 5.7.45 Description: The issue concerns the Email Subscribers by Icegram Express WordPress plugin, which does not properly sanitize and escape some of its Workflow settings. This could all...

PT-2025-4773 · Jte · Jte

Name of the Vulnerable Software and Affected Versions: jte Java Template Engine versions 3.1.15 and earlier Description: The issue affects Jte HTML templates with script tags or script attributes that include a Javascript template string backticks, making them subject to XSS. The javaScriptBlock...

PT-2025-1798 · WordPress · Appointment Booking Calendar Plugin

Name of the Vulnerable Software and Affected Versions: Appointment Booking Calendar Plugin and Scheduling Plugin versions prior to 1.1.23 Description: The export settings functionality in the Appointment Booking Calendar Plugin and Scheduling Plugin exports data to a public folder with an easily...

EulerOS 2.0 SP10 : vim (EulerOS-SA-2025-1016)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. A use-after-free was found in Vim 9.1.0764. When closing a buffer visible in a window a BufWinLeave...

[SECURITY] [DLA 4014-1] gnuchess security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4014-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz January 12, 2025 https://wiki.debian.org/LTS -...

CVE-2025-0396 exelban stats XPC Service shouldAcceptNewConnection command injection

A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading t...

CVE-2025-0392

CVE-2025-0392 affects Guangzhou Huayi Intelligent Technology Jeewms. The vulnerability targets the datagridGraph function in /graphReportController.do, where manipulating the store_code parameter results in SQL injection. It is exploitable remotely, and public disclosure is noted. Remediation per...

CVE-2025-0391 Guangzhou Huayi Intelligent Technology Jeewms CgFormBuildController. java saveOrUpdate sql injection

A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This issue affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController. java. The manipulation leads to sql...

CVE-2025-0390

A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of the file /wmOmNoticeHController.do. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploi...

CVE-2025-0390

CVE-2025-0390 affects Guangzhou Huayi Intelligent Technology’s JeeWMS up to version 20241229. The issue is a path traversal in the unknown-code path to /wmOmNoticeHController.do, exploitable remotely over a network with no authentication, using traversal '../filedir'. The vulnerability is publicl...

PT-2025-4832 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.74 Description: The issue concerns bugs and vulnerabilities in the Linux kernel. The estimated number of potentially affected devices and details about real-world incidents are not specified. Technical detai...

Mozilla Thunderbird SEoL (5.x)

According to its version, Mozilla Thunderbird version install on the remote host has reached end of support. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may...

Microsoft Windows 11 22H2 Pro SEoL

Microsoft Windows 11 22H2 Pro is no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...

PT-2025-3866

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.13 through 2.40 Description The issue is related to the assert function in the GNU C Library, which fails to allocate sufficient space for the assertion failure message string and size information. This may lead to a...

PT-2025-4770 · Freetype +1 · Freetype +1

Name of the Vulnerable Software and Affected Versions: FreeType version 2.8.1 Description: The issue is a signed integer overflow in the cf2 doFlex function, located in cff/cf2intrp.c. This overflow can occur during flex processing. Recommendations: For FreeType version 2.8.1, consider applying a...

openSUSE 15: libpython3_9-1_0 / libpython3_9-1_0-32bit / python39 / etc (SUSE-SU-2025:0047-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0047-1 advisory. This update for python39 fixes the following issue: - Update to 3.9.21 Tenable has extracted the preceding description block directly from the SUSE...

Mozilla Firefox SEoL (74.x)

According to its version, Mozilla Firefox version install on the remote host has reached end of support. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may conta...

[SECURITY] [DLA 4009-1] webkit2gtk security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4009-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort January 09, 2025 https://wiki.debian.org/LTS -...

Debian dsa-5840 : chromium - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5840 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5840-1 [email protected] https://www.debian.org/security/ Andres...