CVE-2025-2173 libzvbi conv.c vbi_strndup_iconv_ucs2 uninitialized pointer

A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbistrndupiconvucs2 of the file src/conv.c. The manipulation of the argument srclength leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has...

CVE-2025-2173 libzvbi conv.c vbi_strndup_iconv_ucs2 uninitialized pointer

A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbistrndupiconvucs2 of the file src/conv.c. The manipulation of the argument srclength leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has...

CVE-2025-2173

CVE-2025-2173 affects libzvbi up to 0.2.43, specifically the function _vbi_strndup_iconv_ucs2 in src/conv.c. The issue is an uninitialized pointer caused by improper handling of src_length, enabling a remote attack and, per sources, an exploit has been disclosed publicly. Multiple advisories conf...

CVE-2025-2113

A vulnerability was found in AT Software Solutions ATSVD up to 3.4.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component Esqueceu a senha. The manipulation of the argument txtCPF leads to sql injection. The attack may be launched remotely. The...

PT-2025-10852 · Zoom · Zoom Workplace Apps

Name of the Vulnerable Software and Affected Versions: Zoom Workplace Apps for iOS versions prior to 6.3.0 Description: The issue is related to incorrect behavior order in some Zoom Workplace Apps for iOS, which may allow an authenticated user to conduct a denial of service via network access...

PT-2025-10924 · Unknown · Skrill Official

Name of the Vulnerable Software and Affected Versions: Skrill Official versions 1.0.0 through 1.0.65 Description: The issue is related to a Cross-Site Request Forgery CSRF problem. This means that an attacker can trick a user into performing unintended actions on a web application that the user i...

PT-2025-10818 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel versions prior to the fixed version Microsoft Office Online Server version 1.0.0 Description: The issue is a stack-based buffer overflow in Microsoft Office Excel, allowing an unauthorized attacker to execute arbitrary...

Siemens Teamcenter Visualization and Tecnomatix

SUMMARY Siemens Teamcenter Visualization and Tecnomatrix Plant Simulation contains multiple file parsing vulnerabilities that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead the...

Siemens SINEMA Remote Connect Server

SUMMARY SINEMA Remote Connect Server before V3.2 SP3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Server and recommends to update to the latest version. 2. GENERAL RECOMMENDATIONS As a general security measure, Siemens strongly recommends...

PT-2025-10793 · Adobe · Substance3D - Designer

Name of the Vulnerable Software and Affected Versions: Substance3D - Designer versions 14.1 and earlier Description: The issue is an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...

Siemens OPC UA

SUMMARY The products listed below contain two authentication bypass vulnerabilities that could allow an attacker to gain access to the data managed by the server. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to information disclosure due to hbase-client

Summary hbase-client is used by the ds-cas-lite microservice as part of the HBase API functionality. Vulnerability Details CVEID:CVE-2024-23944 DESCRIPTION: Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child...

Security Bulletin: Vulnerability with DataStage on Cloud Pak for Data related to urllib3

Summary IBM has released the below fix for IBM DataStage on Cloud Pak for Data in response to the vulnerability found. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2019-11236 DESCRIPTION: Python urllib3 is vulnerable to CRLF injection,...

CVE-2025-24813 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to LDAP injection due to hbase-client

Summary hbase-client is used by the ds-cas-lite microservice as part of the HBase API functionality. Vulnerability Details CVEID:CVE-2023-25613 DESCRIPTION: Apache Kerby could allow a remote attacker to conduct an LDAP injection, caused by a flaw in LdapIdentityBackend. By sending a request with ...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to buffer overflow due to the nsdc package

Summary Ncsd is used by DataStage on Cloud Pak for Data as part of the name service lookup. Vulnerability Details CVEID:CVE-2024-33599 DESCRIPTION: nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's nscd fixed size cache is exhausted by client requests then a...

PT-2025-10702 · Libzvbi +5 · Libzvbi +5

Name of the Vulnerable Software and Affected Versions: libzvbi versions 0.2.43 and earlier Description: A vulnerability was found in the function vbi strndup iconv. The manipulation leads to integer overflow. The attack may be launched remotely. Recommendations: For libzvbi versions 0.2.43 and...

Fedora 40 : chromium (2025-762804f16e)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-762804f16e advisory. Update to 134.0.6998.35 CVE-2025-1914: Out of bounds read in V8 CVE-2025-1915: Improper Limitation of a Pathname to a Restricted Directory in DevToo...

Debian dsa-5876 : thunderbird - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5876 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5876-1 [email protected] https://www.debian.org/securit...

Apache Tomcat 9.0.0.M1 < 9.0.99

The version of Tomcat installed on the remote host is prior to 9.0.99. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.99security-9 advisory. - Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/o...