Security Bulletin: Improper Privilege Management vulnerability in IBM Event Streams

Summary IBM Event Streams is vulnerable to Improper Privilege Management vulnerability in Apache Kafka Clients to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments like in a SaaS. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION...

PYSEC-2025-60

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version...

PYSEC-2025-60

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB.This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2.Users are recommended to upgrade to version...

DoS (Denial of Service) Third-Party Dependency in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.9.10, 8.13.6, 8.14.6, 8.15.0, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score ...

DoS (Denial of Service) Third-Party Dependency in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.19.0, 9.4.0, and 9.6.0 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

PT-2025-21247 · Oa System · Oa System

Name of the Vulnerable Software and Affected Versions: OA System versions prior to 2025.01.01 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at the...

PT-2025-21230

Name of the Vulnerable Software and Affected Versions: realme GT 2 RMX3311 running Android 14 with realme UI 5.0 Description: An issue allows a physically proximate attacker to obtain sensitive information via the show app only setting function. Recommendations: For realme GT 2 RMX3311 running...

PT-2025-21925 · V-Sft · V-Sft

Name of the Vulnerable Software and Affected Versions: V-SFT versions 6.2.5.0 and earlier Description: The issue is related to a stack-based buffer overflow in the VS6MemInIF!set temp type default function. Opening specially crafted V7 or V8 files may lead to a crash, information disclosure, and...

PT-2025-21174 · Itop · Itop

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 3.2.1 Description: The issue allows a portal user to see any other contact's picture by changing the picture ID in the URL. Recommendations: For versions prior to 3.2.1, update to version 3.2.1 to resolve the issue...

PT-2025-21225 · Unknown +1 · Pointcloudlibrary +1

Name of the Vulnerable Software and Affected Versions: PointCloudLibrary versions prior to 1.14.0 Description: The issue is an Out-of-bounds Write vulnerability in PointCloudLibrary, allowing Overflow Buffers due to a zlib issue. This vulnerability is relevant for versions older than 1.14.0 or if...

PT-2025-21223

Name of the Vulnerable Software and Affected Versions: PointCloudLibrary PCL versions prior to 1.14.0 Description: A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary PCL. This issue may allow context-dependent attackers to cause...

PT-2025-21145 · Unknown · Cap Collectif

Name of the Vulnerable Software and Affected Versions: Cap Collectif versions prior to the version including commit 812f2a7d271b76deab1175bdaf2be0b8102dd198 Description: The issue concerns the Cap Collectif online decision-making platform, which has a flaw in the DebateAlternateArgumentsResolver...

PT-2025-21921 · V-Sft · V-Sft

Name of the Vulnerable Software and Affected Versions: V-SFT versions 6.2.5.0 and earlier Description: The issue is related to an out-of-bounds read in the VS6EditData!CGamenDataRom::set mr400 strc function. Opening specially crafted V7 or V8 files may lead to a crash, information disclosure, and...

PT-2025-21250

Name of the Vulnerable Software and Affected Versions: net-tools versions up to and including 2.10 Description: The issue is related to the Linux network utilities in the net-tools package, which do not properly validate the structure of /proc files when showing interfaces. This can lead to...

Spidermonkey: Multiple Vulnerabilities

Background SpiderMonkey is Mozilla’s JavaScript and WebAssembly Engine, used in Firefox, Servo and various other projects. It is written in C++, Rust and JavaScript. You can embed it into C++ and Rust projects, and it can be run as a stand-alone shell. Description Multiple vulnerabilities have be...

PT-2025-21196 · Drupal · Enterprise Mfa - Tfa For Drupal

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions. This issue may...

PT-2025-21190 · Unknown · Oembed Providers

Name of the Vulnerable Software and Affected Versions: oEmbed Providers versions 0.0.0 through 2.2.1 Description: The issue affects oEmbed Providers, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. Recommendations: For versions 0.0.0 through...

PT-2025-21173 · Itop · Itop

Name of the Vulnerable Software and Affected Versions: iTop version 3.2.0 Description: The issue allows an attacker to send a URL to the server, triggering a PHP error. This error causes the start page to crash for the next user attempting to load the dashboard. Recommendations: For version 3.2.0...

PT-2025-21189 · Unknown · Restrict Route By Ip

Name of the Vulnerable Software and Affected Versions: Restrict route by IP versions 0.0.0 through 1.2.x Restrict route by IP version 1.3.0 is not affected, so the correct range is: Restrict route by IP versions 0.0.0 through 1.2.x Description: A Cross-Site Request Forgery CSRF issue affects the...

CVE-2025-4546

A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Knowledge Base Module. The manipulation leads to csv injection. The attack can be launched remotely. The exploit has been...