Security Bulletin: Vulnerability in jsonpath-plus affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in jsonpath-plus has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

PT-2025-22407 · Osamataher · Java-Springboot-Codebase

Name of the Vulnerable Software and Affected Versions: OsamaTaher/Java-springboot-codebase versions prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2 Description: The issue is related to insufficient path traversal mechanisms, making absolute path traversal possible. This allows unauthoriz...

PT-2025-22411 · Github · Github Desktop

Name of the Vulnerable Software and Affected Versions: GitHub Desktop versions prior to 3.4.20 Description: The issue affects GitHub Desktop users on Windows, where an attacker can cause information disclosure by convincing a user to view a malicious file in the history view. This happens because...

PT-2025-22375

Name of the Vulnerable Software and Affected Versions TYPO3 ns backup extension versions prior to 13.0.1 Description The issue allows for XSS. Recommendations For versions prior to 13.0.1, update to version 13.0.1 or later to resolve the issue...

PT-2025-22322 · Hkcms · Hkcms

Name of the Vulnerable Software and Affected Versions: HkCms versions up to 2.3.2.240702 Description: A problematic issue was found in HkCms, affecting an unknown part of the file /index.php/search/index.html of the component Search. The manipulation of the keyword argument leads to cross-site...

PT-2025-22394 · Cisco · Cisco Webex

Name of the Vulnerable Software and Affected Versions: Cisco Webex affected versions not specified Description: A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The issue is due to improper filtering of user-supplied inpu...

PT-2025-22352 · Unknown · Konsola Proget

Name of the Vulnerable Software and Affected Versions: Konsola Proget versions prior to 2.17.5 Description: The issue arises from input in the activationMessage field not being sanitized correctly in Konsola Proget, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack...

PT-2025-22366

Name of the Vulnerable Software and Affected Versions jq versions up to and including 1.7.1 Description The issue arises from an integer overflow when assigning a value using an index of 2147483647, which is the signed integer limit. This causes a denial of service. Recommendations For versions u...

PT-2025-22389 · Drupal · Drupal One Time Password

Name of the Vulnerable Software and Affected Versions: Drupal One Time Password versions 0.0.0 through 1.3.0 Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password, allowing functionality bypass. Recommendations:...

PT-2025-22388 · Drupal · Drupal One Time Password

Name of the Vulnerable Software and Affected Versions: Drupal One Time Password versions 0.0.0 through 1.3.0 Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password, allowing functionality bypass. Recommendations:...

PT-2025-22327 · Unknown +1 · Clickhouse +1

Name of the Vulnerable Software and Affected Versions: Clickhouse versions prior to 19.14.3.3 Description: A stack overflow leading to a denial of service DoS can be triggered by a malicious authenticated client. Recommendations: For versions prior to 19.14.3.3, update to version 19.14.3.3 or lat...

PT-2025-22442 · Unknown +6 · Modsecurity +6

Name of the Vulnerable Software and Affected Versions: ModSecurity versions up to and including 2.9.8 modsecurity-apache version 2.9.3-3+deb11u3 and earlier for Debian 11 bullseye modsecurity-apache version 2.9.7-1+deb12u1 and earlier for Debian bookworm Description: A flaw was found in the mod...

Privacy-Preserving Socialized Recommendation Based on Multi-View Clustering in a Cloud Environment

Recommendation as a service has improved the quality of our lives and plays a significant role in variant aspects. However, the preference of users may reveal some sensitive information, so that the protection of privacy is required. In this paper, we propose a privacy-preserving, socialized,...

PT-2025-22337 · WordPress · Wp Youtube Video Optimizer

Name of the Vulnerable Software and Affected Versions: WP YouTube Video Optimizer plugin for WordPress versions up to, and including, 1.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'ib youtube' shortcode due to insufficient input sanitization and output...

PT-2025-22408 · Unknown +1 · Kubernetes Containerd

Name of the Vulnerable Software and Affected Versions: containerd versions 2.0.1 through 2.0.4 Description: A bug was found in containerd's CRI implementation where it doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, causing some Kubernetes limits to not be honored...

PT-2025-22341 · WordPress · The Glossary

Name of the Vulnerable Software and Affected Versions: The Glossary by WPPedia – Best Glossary plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to PHP Object Injection via deserialization of untrusted input from the posttypes parameter. This allows...

PT-2025-22328 · WordPress · Affiliate Sales In Google Analytics/Other Tools

Name of the Vulnerable Software and Affected Versions: The Affiliate Sales in Google Analytics and other tools plugin for WordPress versions up to, and including, 1.4.9 Description: The issue is due to insufficient validation on the redirect url supplied via the afflink parameter. This makes it...

CVE-2025-5007 Part-DB Profile Picture Feature AttachmentSubmitHandler.php handleUpload cross site scripting

A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file src/Services/Attachments/AttachmentSubmitHandler.php of the component Profile Picture Feature. The manipulation of the argument attachmen...

Improper Neutralization of Escape, Meta, or Control Sequences

Overview Affected versions of this package are vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences via the Hubble CLI terminal output processing. An attacker can manipulate the output to conceal log entries, rewrite output, or make the terminal temporarily unusable by...

DoS (Denial of Service) Third-Party Dependency in Jira Software Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 9.12.0, 10.2.0, 10.3.0, 10.4.0, 10.5.0, and 10.6.0 of Jira Software Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...