Siemens SIPROTEC 5

SUMMARY Affected SIPROTEC 5 devices contain a development shell which is accessible via a physical interface which is not properly restricted. This could allow an unauthenticated attacker with physical access to an affected device to execute arbitrary commands on the device. Siemens has released...

AMD GPU Security Vulnerabilities

AMD ID: AMD-SB-6016 Potential Impact: Varies by CVE, see descriptions below Severity: Varies by CVE, see descriptions below Summary Potential security vulnerabilities in the Satellite Management Controller SMC in AMD Instinct™ MI300X accelerators were discovered during internal audit/penetration...

CGA-285G-XPR3-78GW

Bulletin has no description...

Apple Security Update: macOS Sonoma 14.7.4

Apple recommends to install security update macOS Sonoma 14.7.4 on devices macOS Sonoma...

PT-2025-25364

Name of the Vulnerable Software and Affected Versions Apple watchOS versions 11.3.1 and later Apple macOS Ventura versions 13.7.4 and later Apple iOS versions 15.8.4 and later Apple iPadOS versions 15.8.4 and later Apple iOS versions 16.7.11 and later Apple iPadOS versions 16.7.11 and later Apple...

PT-2025-6097

Name of the Vulnerable Software and Affected Versions iOS versions prior to 18.3.1 iPadOS versions prior to 18.3.1 iPadOS versions prior to 17.7.5 Description A physical attack may disable USB Restricted Mode on a locked device. This issue is related to an authorization problem that has been...

Chinese-Speaking Group Manipulates SEO with BadIIS

This blog post details our analysis of an SEO manipulation campaign targeting Asia. We also share recommendations that can help enterprises proactively secure their environment...

PT-2025-6006 · Tp Link · Tplink Tl-Wpa 8630

Name of the Vulnerable Software and Affected Versions: TPLINK TL-WPA 8630 version 2.0.4 Build 20230427 Description: An issue in TPLINK TL-WPA 8630 allows a remote attacker to execute arbitrary code via function sub 4256CC, which allows command injection by injecting devpwd. Recommendations: As a...

PT-2025-5906 · Ibl Software Engineering · Ibl Software Engineering Visual Weather

Name of the Vulnerable Software and Affected Versions: IBL Software Engineering Visual Weather versions prior to 7.3.10 IBL Software Engineering Visual Weather versions prior to 8.6.0 Description: A security issue has been identified in the Product Delivery Service PDS component of IBL Software...

PT-2025-25433

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 16.4.7 XWiki versions prior to 16.10.3 XWiki versions prior to 17.0.0 Description XWiki is a generic wiki platform that warns about the execution of "dangerous" macros like malicious script macros authored by a user wit...

CVE-2024-45626 Apache James: denial of service through JMAP HTML to text conversion

Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue...

BIT-CASSANDRA-2025-24860 Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions

Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer. Users with restricted data center access can update their own permissions via data control...

PT-2025-5834 · Unknown · Tiny File Manager

Name of the Vulnerable Software and Affected Versions: Tiny File Manager versions 2.4.7 and below Description: The issue concerns session fixation. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where thi...

PT-2025-5840 · Douphp · Douphp

Name of the Vulnerable Software and Affected Versions: DouPHP version 1.8 Release 20231203 Description: The issue allows attackers to execute arbitrary code via a crafted payload injected into the description parameter in "/admin/article.php" API endpoint. This enables attackers to perform...

PT-2025-5838 · Phpjabbers · Phpjabbers Cinema Booking System

Name of the Vulnerable Software and Affected Versions: PHPJabbers Cinema Booking System version 2.0 Description: A cross-site request forgery CSRF vulnerability in the pjActionUpdate function allows remote attackers to escalate privileges by tricking an authenticated admin into submitting an...

PT-2025-5829

Name of the Vulnerable Software and Affected Versions Trimble Cityworks versions prior to 15.8.9 Trimble Cityworks with office companion versions prior to 23.10 Description A deserialization vulnerability could allow an authenticated user to perform a remote code execution attack against a...

Security Bulletin: Vulnerability in GNOME GLibl affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary A potential vulnerability in GNOME GLib has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-34397 DESCRIPTION: GNOME GLib could allow a...

CVE-2025-24372 XSS vector in user uploaded images in group/org and user profiles in ckan

CKAN is an open-source DMS data management system for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could...

Security Bulletin: Vulnerability in MIT Kerberos 5 (aka krb5) affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary Potential vulnerabilities in MIT Kerberos 5 aka krb5 has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. These vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-37370 DESCRIPTION: MIT...

CVE-2024-52457

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in youneeq Youneeq Recommendations youneeq-panel allows Reflected XSS.This issue affects Youneeq Recommendations: from n/a through = 3.0.7...