Malvertising campaign leads to info stealers hosted on GitHub

In early December 2024, Microsoft Threat Intelligence detected a large-scale malvertising campaign that impacted nearly one million devices globally in an opportunistic attack to steal information. The attack originated from illegal streaming websites embedded with malvertising redirectors, leadi...

CVE-2024-56202

Apache Traffic Server is vulnerable to an Expected Behavior Violation (CWE-440) in versions 9.0.0 through 9.2.8 and 10.0.0 through 10.0.3 . This vulnerability in the reverse and forward proxy server could lead to denial of service , HTTP request smuggling , cache poisoning , or incomplete droppin...

PT-2025-9992 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: PublicCMS version 4.0.202406 Description: The issue is related to an arbitrary file upload vulnerability in the /cms/CmsWebFileAdminController.java component. This allows attackers to execute arbitrary code by uploading a crafted svg or xml...

PT-2025-9910 · Unknown · Unifiedtransform

Name of the Vulnerable Software and Affected Versions: Unifiedtransform version 2.0 Description: The issue is related to incorrect access control in Unifiedtransform, leading to privilege escalation. This allows teachers to update the personal data of fellow teachers. Recommendations: For...

PT-2025-9898 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.4.26.71 Description: The issue is related to an out-of-bounds read in parsing image data, allowing local attackers to access out-of-bounds memory. Recommendations: For versions prior to 4.4.26.71, update to...

PT-2025-16582

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.11 Description A vulnerability in the Linux kernel's xhci driver has been resolved. The issue occurred when handling Stoppend and Stopped - Length Invalid events, where the driver did not skip missed isochronou...

Linux Distros Unpatched Vulnerability : CVE-2024-50379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the...

PT-2025-14335

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the netmem feature. The issue allowed the transmission of unreadable network memory netmem packets into the device's...

PT-2025-9870 · Unknown · Unifiedtransform

Name of the Vulnerable Software and Affected Versions: Unifiedtransform version 2.0 Description: The issue is related to incorrect access control in Unifiedtransform 2.0, which leads to privilege escalation. This allows teachers to change the section name and room number, permissions that should ...

Linux Distros Unpatched Vulnerability : CVE-2023-37895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including...

Linux Distros Unpatched Vulnerability : CVE-2022-3509

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a...

PT-2025-9833 · Opentext · Opentext Identity Manager Advanced Edition

Name of the Vulnerable Software and Affected Versions: OpenText Identity Manager Advanced Edition versions 4.8.0.0 through 4.9.0.0 Description: The issue is related to insufficiently protected credentials, allowing an authenticated user to obtain higher privileged user’s sensitive information via...

Linux Distros Unpatched Vulnerability : CVE-2023-46121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a...

Edimax IC-7100 IP Camera

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to send specially crafted requests to achieve remote code execution on the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...

Delta Electronics CNCSoft-G2

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute code remotely. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact...

DoS (Denial of Service) io.netty:netty-handler Dependency in Bamboo Data Center and Server

This High severity io.netty:netty-handler Dependency vulnerability was introduced in versions 9.5.0, 9.6.0, 10.0.0, 10.1.0, and 10.2.0 of Bamboo Data Center and Server. This io.netty:netty-handler Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

PT-2025-9664

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 136 Description The Custom Tabs feature in Android apps can load web pages and supports a transition animation. This animation could be used to deceive users into granting sensitive permissions by concealing what they...

PT-2025-9668

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 136 Thunderbird versions prior to 136 Description The issue is related to memory safety bugs that could potentially lead to memory corruption. It is presumed that with sufficient effort, some of these bugs could be...

PT-2025-9657 · Mozilla +9 · Firefox +9

Name of the Vulnerable Software and Affected Versions: Firefox versions 122 through 135 Firefox ESR versions 122 through 128.7 Description: The issue is related to an inconsistent comparator in xslt/txNodeSorter, potentially leading to out-of-bounds access. Recommendations: For Firefox versions 1...

PT-2025-9659 · Mozilla +10 · Firefox +10

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 136 Firefox ESR versions prior to 128.8 Description: A RegExp bailout processing issue allowed additional JavaScript execution, potentially triggering unexpected garbage collection. Recommendations: For Firefox...