CVE-2025-3539

A vulnerability classified as critical has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected is the function FCGICheckStringIfContainsSemicolon of the file /api/wizard/getBasicInfo of the component HTTP POST Request Handler. The...

CVE-2025-3539 H3C Magic BE18000 HTTP POST Request getBasicInfo FCGI_CheckStringIfContainsSemicolon command injection

A vulnerability classified as critical has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected is the function FCGICheckStringIfContainsSemicolon of the file /api/wizard/getBasicInfo of the component HTTP POST Request Handler. The...

Incorrect Behavior Order: Early Validation

Overview lockfile-lint-api is a Lint an npm or yarn lockfile to analyze and detect issues Affected versions of this package are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name...

PT-2025-16177 · Unknown · Youdiancms

Name of the Vulnerable Software and Affected Versions: YouDianCMS version 9.5.21 Description: A vulnerability was found in YouDianCMS, affecting unknown code of the file /App/Tpl/Member/Default/Order/index.html. The manipulation of the OrderNumber argument leads to cross-site scripting. The attac...

Debian dla-4124 : fonts-glyphicons-halflings - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4124 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4124-1 [email protected] https://www.debian.org/lts/security/...

Azure Linux 3.0 Security Update: subversion (CVE-2024-46901)

The version of subversion installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46901 advisory. - Insufficient validation of filenames against control characters in Apache Subversion repositories served...

GHSA-M454-3XV7-QJ85 CVE-2025-1386- Query smuggling in ch-go library

Impact When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream. Patches If you are using ch-go library, we...

PT-2025-16171 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.7.1012 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the widgetGri...

Advisory ROSA-SA-2025-2829

Software: postgresql-jdbc 42.2.28 OS: ROSA Virtualization 3.0 packageevrstring: postgresql-jdbc-42.2.28-1.0.1.rv30 CVE-ID: CVE-2024-1597 BDU-ID: 2024-01541 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the JDBC driver pgjdbc for connecting Java programs to a PostgreSQL database is related to...

CVE-2017-20197

A vulnerability was found in propanetank Roommate-Bill-Tracking up to 288437f658fc9ee7d4b92a9da12557024d8bc55c. It has been declared as critical. This vulnerability affects unknown code of the file /includes/login.php. The manipulation of the argument Username leads to sql injection. The attack c...

CVE-2025-31362

Use of hard-coded cryptographic key issue exists in BizRobo! all versions. Credentials inside robot files may be obtained if the encryption key is available. The vendor provides the workaround information and recommends to apply it to the deployment environment...

CVE-2025-31932

Deserialization of untrusted data issue exists in BizRobo! all versions. If this vulnerability is exploited, an arbitrary code is executed on the Management Console. The vendor provides the workaround information and recommends to apply it to the deployment environment...

PT-2025-16055

Name of the Vulnerable Software and Affected Versions: ThemeAtelier IDonate versions 2.1.8 and earlier Description: The issue is related to an improper control of filename for include/require statement in a PHP program, also known as PHP Remote File Inclusion, which allows PHP Local File Inclusio...

PT-2025-16047 · Unknown · Insert Html Here

Name of the Vulnerable Software and Affected Versions: Insert HTML Here versions prior to 1.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-site Scripting XSS. Specifically, it enables Reflected XSS. Recommendations: For...

PT-2025-16113 · Debian +1 · Debian +1

Name of the Vulnerable Software and Affected Versions: Taegis Endpoint Agent Linux versions prior to 1.3.10 Description: A code injection issue in the Debian package component allows local users to execute arbitrary code as root. This issue does not affect Redhat-based systems that use RPM...

PT-2025-16071 · WordPress · Empikplace For Woocommerce

Name of the Vulnerable Software and Affected Versions: EmpikPlace for Woocommerce versions 1.4.2 and earlier Description: The issue is related to the deserialization of untrusted data, which allows object injection. This is a problem where an attacker could potentially inject malicious objects in...

EulerOS 2.0 SP11 : binutils (EulerOS-SA-2025-1347)

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemblebytes of the fil...

PT-2025-16054 · Scand · Scand Multimailer

Name of the Vulnerable Software and Affected Versions: SCAND MultiMailer versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

Apache Parquet < 1.15.1 Remote Code Execution (CVE-2025-30065)

The version of Apache Parquet on the remote host is prior to 1.15.1. It is, therefore, affected by a remote code execution vulnerability: - Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to...

Fedora 40 : thunderbird (2025-4841d72caf)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4841d72caf advisory. Update to 128.9.0 https://www.thunderbird.net/en-US/thunderbird/128.9.0esr/releasenotes/...