Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to exposure of sensitive data and authorization bypass due to the Apache ZooKeeper package (CVE-2024-23944, CVE-2023-44981)

Summary Apache ZooKeeper is used by DataStage on Cloud Pak for Data as part of configuration synchronization. Vulnerability Details CVEID:CVE-2024-23944 DESCRIPTION: Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monit...

CVE-2025-5952

A vulnerability, which was classified as critical, has been found in Zend.To up to 6.10-6 Beta. This issue affects the function exec of the file NSSDropoff.php. The manipulation of the argument file1 leads to os command injection. The attack may be initiated remotely. The exploit has been disclos...

CVE-2025-5935

A vulnerability was found in Open5GS up to 2.7.3. It has been declared as problematic. Affected by this vulnerability is the function commonregisterstate of the file src/mme/emm-sm.c of the component AMF/MME. The manipulation of the argument ranueid leads to denial of service. The attack can be...

GTK+ 3: Search path vulnerability

Background GTK+ GIMP Toolkit + is a toolkit for creating graphical user interfaces. Description A vulnerability has been discovered in GTK+ 3. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifier for details. Workaround There is no kno...

Siemens Mendix Studio Pro

SUMMARY Mendix Studio Pro contains a vulnerability in the module installation process, that could allow an attacker to write or modify arbitrary files in directories outside a developer’s project directory. Siemens has released new versions for several affected products and recommends to update...

EulerOS 2.0 SP11 : elfutils (EulerOS-SA-2025-1650)

According to the versions of the elfutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function...

Insertion of Sensitive Information Into Sent Data

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data. Go Vulnerability Report: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially...

[SECURITY] [DLA 4213-1] curl regression update

Debian LTS Advisory DLA-4213-1 [email protected] https://www.debian.org/lts/security/ Carlos Henrique Lima Melara June 11, 2025 https://wiki.debian.org/LTS Package : curl Version : 7.74.0-1.3+deb11u15 The initial fix for CVE-2023-27534 in curl made the handling of tilde way more strict ...

Improper Authorization org.apache.tomcat.embed:tomcat-embed-core Dependency in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.19.0, 9.4.0, and 9.6.0 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.3 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L allows an...

Security Bulletin: IBM Verify Identity Access is affected by a security vulnerability (CVE-2025-0163)

Summary IBM Verify Identity Access has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2025-0163 DESCRIPTION: IBM Security Verify Access Appliance could allow a remote attacker to enumerate usernames due to an observable response discrepancy of disabled accounts...

PT-2025-25180 · WordPress · Wp-Downloadmanager

Name of the Vulnerable Software and Affected Versions: WP-DownloadManager plugin for WordPress versions up to, and including, 1.68.10 Description: The issue is due to a lack of restriction on the directory an administrator can select for storing downloads, making it possible for authenticated...

EulerOS 2.0 SP13 : git (EulerOS-SA-2025-1631)

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are transported from the...

PT-2025-25252 · Joomla · Rstickets!

Name of the Vulnerable Software and Affected Versions: RSTickets! component versions 1.9.12 through 3.3.0 for Joomla Description: A stored XSS issue allows attackers to perform cross-site scripting XSS attacks via sending crafted payload. Recommendations: For RSTickets! component versions 1.9.12...

Debian dla-4214 : node-tar-fs - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4214 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4214-1 [email protected]...

CVE-2025-22829

The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for...

CVE-2025-30675 Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins

In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attack...

CVE-2025-47713 Apache CloudStack: Domain Admin can reset Admin password in Root Domain

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can reset the password of user-accounts of Admin role type. This operation is not appropriately restricted and allows the attacker to assume...

CVE-2024-37395

A stored cross-site scripting XSS vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Survey Title' and 'Survey Instructions' fields. This vulnerability could be exploited by...

CVE-2025-5935

A vulnerability was found in Open5GS up to 2.7.3. It has been declared as problematic. Affected by this vulnerability is the function commonregisterstate of the file src/mme/emm-sm.c of the component AMF/MME. The manipulation of the argument ranueid leads to denial of service. The attack can be...

CVE-2025-5952 Zend.To NSSDropoff.php exec os command injection

A vulnerability, which was classified as critical, has been found in Zend.To up to 6.10-6 Beta. This issue affects the function exec of the file NSSDropoff.php. The manipulation of the argument file1 leads to os command injection. The attack may be initiated remotely. The exploit has been disclos...