PT-2025-19760 · Hcl · Hcl Bigfix Compliance

Name of the Vulnerable Software and Affected Versions: HCL BigFix Compliance affected versions not specified Description: The issue is related to an improper or missing SameSite attribute, which can lead to Cross-Site Request Forgery CSRF attacks. A malicious site could trick a user's browser int...

PT-2025-20023 · Rt · Rt-Labs P-Net

Name of the Vulnerable Software and Affected Versions: RT-Labs P-Net versions 1.0.1 and earlier Description: The issue is related to an unchecked input for a loop condition, which allows an attacker to cause IO devices using the library to enter an infinite loop by sending a malicious RPC packet...

PT-2025-19724 · NetGear · Netgear Rax5

Name of the Vulnerable Software and Affected Versions: NETGEAR RAX5 version 1.0.2.26 Description: A command injection issue was discovered in the NETGEAR RAX5 AX1600 WiFi Router via the iface parameter in the vif enable function. This allows for potential exploitation. Recommendations: For versio...

Security Bulletin: Vulnerability in commons-compress affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-25710, CVE-2024-26308].

Summary The commons-compress package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-25710, CVE-2024-26308. Vulnerability Details CVEID:CVE-2024-25710 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop'...

Security Bulletin: XML External Entity (XXE) injection vulnerability affects IBM Business Automation Workflow - CVE-2023-4218

Summary IBM Business Automation Workflow containers package a vulnerable copy of eclipse jars. Vulnerability Details CVEID:CVE-2023-4218 DESCRIPTION: Eclipse IDE could allow a local authenticated attacker to obtain sensitive information, caused by improper handling of XML external entity XXE...

Security Bulletin: Security vulnerability in Apache Kafka clients affects IBM Business Automation Workflow Case Event Emitters - CVE-2024-31141

Summary IBM Business Automation Workflow Case Event Emitters package a vulnerable version of Apache Kafka clients. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION: Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apac...

PT-2025-18959 · Unknown · Bluewave Checkmate

Name of the Vulnerable Software and Affected Versions: BlueWave Checkmate versions through 2.0.2 before d4a6072 Description: The issue allows an invite request to be modified to specify a privileged role. Recommendations: For BlueWave Checkmate versions through 2.0.2 before d4a6072, consider...

PT-2025-18938 · Gnu +1 · Gnu Pspp +1

Name of the Vulnerable Software and Affected Versions: GNU PSPP versions through 2.0.1 Description: The issue allows attackers to cause a denial of service, resulting in an application exit, via crafted input data. This can be triggered by specific data that causes a call from the...

PT-2025-18955 · Unknown · Code-Projects Online Bus Reservation Site

Name of the Vulnerable Software and Affected Versions: code-projects Online Bus Reservation System version 1.0 Description: A critical issue has been found in the system, affecting some unknown functionality of the file /print.php. The manipulation of the ID argument leads to SQL injection. The...

PT-2025-18932 · WordPress · Verticalresponse Newsletter Widget

Name of the Vulnerable Software and Affected Versions: VerticalResponse Newsletter Widget plugin for WordPress versions up to, and including, 1.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'verticalresponse' shortcode due to insufficient input sanitization a...

PT-2025-18928 · WordPress · Personizely

Name of the Vulnerable Software and Affected Versions: Personizely plugin for WordPress versions up to, and including, 0.10 Description: The issue is related to Stored Cross-Site Scripting via the widgetId parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-18936 · WordPress · Database Toolset

Name of the Vulnerable Software and Affected Versions: Database Toolset plugin for WordPress versions up to, and including, 1.8.4 Description: The issue allows unauthenticated attackers to extract sensitive data from database backup files stored in a publicly accessible location. This is possible...

CVE-2025-4215 gorhill uBlock Origin UI 1p-filters.js currentStateChanged redos

A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the file src/js/1p-filters.js of the component UI. The manipulation leads to inefficient regular expression complexity. It is possible to laun...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in DOMPurify

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of DOMPurify Vulnerability Details CVEID:CVE-2024-47875 DESCRIPTION: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerabilit...

Security Bulletin: IBM watsonx Orchestrate with watsonx Assistant Cartridge affected by vulnerability in dompurify

Summary IBM watsonx Orchestrate with watsonx Assistant Cartridge contains a vulnerable version of dompurify Vulnerability Details CVEID:CVE-2024-48910 DESCRIPTION: DOMPurify could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype pollution. By...

PT-2025-18768 · Gosoft · Gosoft Software Proticaret E-Commerce

Name of the Vulnerable Software and Affected Versions: Gosoft Software Proticaret E-Commerce versions prior to 6.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack wher...

PT-2025-18793 · Dassault Systèmes · Solidworks Edrawings

Name of the Vulnerable Software and Affected Versions: SOLIDWORKS eDrawings version 2025 Description: An Out-Of-Bounds Write issue exists in the OBJ file reading procedure. This could allow an attacker to execute arbitrary code when opening a specially crafted OBJ file. Recommendations: For versi...

PT-2025-18925 · Opengrok · Opengrok

Name of the Vulnerable Software and Affected Versions: OpenGrok version 1.13.25 Description: The issue is a reflected Cross-Site Scripting XSS problem that occurs when the application generates the history view page. This happens due to improper handling of path segments, causing the application ...

PT-2025-18914 · Obfstr · Obfstr

Name of the Vulnerable Software and Affected Versions: obfstr crate versions prior to 0.4.4 Description: The issue arises from the obfstr! argument type not being restricted to string slices, resulting in invalid UTF-8 conversion that produces an invalid value. Recommendations: For versions prior...

PT-2025-18924 · FFmpeg +1 · Ffmpeg +1

Name of the Vulnerable Software and Affected Versions: ffmpeg version 7.1 Description: The issue is related to a Null Pointer Dereference in the iamf read header function located in /libavformat/iamfdec.c. This is a general information about the problem, but specific details about the number of...