Debian dla-4073 : ffmpeg - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4073 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4073-1 [email protected]...

PT-2025-9104 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart versions prior to 4.1.0 Description: The issue allows an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in the "/account/voucher" API endpoint. This could potentially...

[SECURITY] [DSA 5871-1] emacs security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5871-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 27, 2025 https://www.debian.org/security/faq -...

GHSA-XR9Q-H9C7-XW8Q Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API

Impact An unauthenticated stack overflow crash, leading to a denial of service DoS, was identified in Rancher’s /v3-public/authproviders public API endpoint. A malicious user could submit data to the API which would cause the Rancher server to crash, but no malicious or incorrect data would...

CVE-2024-9285

A vulnerability was found in Tu Yafeng Via Browser up to 5.9.0 on Android. It has been rated as problematic. This issue affects some unknown processing of the component Javascript Bridge. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2024-9285 Tu Yafeng Via Browser Javascript Bridge cross site scripting

A vulnerability was found in Tu Yafeng Via Browser up to 5.9.0 on Android. It has been rated as problematic. This issue affects some unknown processing of the component Javascript Bridge. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2024-9285

CVE-2024-9285 affects Tu Yafeng Via Browser for Android up to version 5.9.0. The issue stems from how the Javascript Bridge component is processed, enabling a remote attacker to trigger a cross-site scripting vulnerability. This is described across multiple sources, with public disclosure and a r...

CVE-2025-1741

CVE-2025-1741 affects b1gMail up to version 7.4.1-pl1 in the Admin Page component (src/admin/users.php). The vulnerability arises from deserialization when manipulating the query/q parameter, allowing remote exploitation. A fix is available: upgrade to 7.4.1-pl2 (patch identifier 4816c8b748f6a5b9...

CVE-2025-1741 b1gMail Admin Page users.php deserialization

A vulnerability classified as problematic was found in b1gMail up to 7.4.1-pl1. Affected by this vulnerability is an unknown functionality of the file src/admin/users.php of the component Admin Page. The manipulation of the argument query/q leads to deserialization. The attack can be launched...

Security Bulletin: Vulnerability in tornado affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0)[CVE-2023-28370]

Summary The tornado package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVEsCVE-2023-28370 Vulnerability Details CVEID:CVE-2023-28370 DESCRIPTION: Tornado could allow a remote attacker to conduct phishing attacks, caused by an open...

Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to expose information, inject code, manipulate data, or achieve cross-site scripting XSS, resulting in full session compromise. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...

DoS (Denial of Service) org.bouncycastle:bcprov-jdk18on Dependency in Bitbucket Data Center and Server

This High severity org.bouncycastle:bcprov-jdk18on Dependency vulnerability was introduced in versions 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0, 8.9.0, 8.10.0, 8.11.0, 8.12.0, 8.13.0, 8.14.0-eap01, 8.15.0, 8.16.0, 8.17.0, 8.18.0, and 8.19.0 of Bitbucket Data Center. This...

Security Bulletin: IBM Event Processing is vulnerable to Regular Expression Denial of Service (ReDoS) due to the cross-spawn package (CVE-2024-21538).

Summary Operator of IBM Event Processing is vulnerable to Regular Expression Denial of Service ReDoS due to the usage of cross-spawn package. The cross-spawn npm package is a cross-platform solution for spawning child processes in Node.js. Vulnerability Details CVEID:CVE-2024-21538 DESCRIPTION:...

CVE-2025-1643

A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of the file /DadosPessoais/SGAlterarSenha. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.1....

Debian dla-4069 : emacs - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4069 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4069-1 [email protected]...

CBL Mariner 2.0 Security Update: vim (CVE-2025-1215)

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-1215 advisory. - A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown co...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in urllib3

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of urllib3. Vulnerability Details CVEID:CVE-2024-37891 DESCRIPTION: urllib3 could allow a remote authenticated attacker to obtain sensitive information, caused by the failure to strip the Proxy-Authorization header during...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in aiohttp

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of aiohttp Vulnerability Details CVEID:CVE-2024-42367 DESCRIPTION: aio-libs aiohttp ould allow a remote attacker to traverse directories on the system, caused by improper archive file validation. An attacker could use a...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in source-map-support

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of source-map-support. Vulnerability Details CVEID:CVE-2024-21540 DESCRIPTION: All versions of the package source-map-support are vulnerable to Directory Traversal in the retrieveSourceMap function. CWE:CWE-22: Improper...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Elliptic

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of Elliptic. Vulnerability Details CVEID:CVE-2024-48949 DESCRIPTION: The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S.gtesig.eddsa.curve.n || sig.S.isNeg"...