Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in http-proxy-middleware

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of http-proxy-middleware. Vulnerability Details CVEID:CVE-2024-21536 DESCRIPTION: http-proxy-middleware is vulnerable to a denial of service, caused by an UnhandledPromiseRejection error thrown by micromatch. By sending...

Security Bulletin: Vulnerability in urllib3 affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0)[CVE-2023-43804]

Summary The urllib3 package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVEsCVE-2023-43804 Vulnerability Details CVEID:CVE-2023-43804 DESCRIPTION: urllib3 could allow a remote authenticated attacker to obtain sensitive information,...

PT-2025-7945 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A race condition exists between ctrl cdev ioctl and ubi cdev ioctl in the Linux kernel. This issue is caused by the locks held by these two functions, ubi devices mutex and ubi-device...

PT-2025-8680 · WordPress · Simple Catalogue

Name of the Vulnerable Software and Affected Versions: Simple catalogue WordPress plugin versions 1.0.0 through 1.0.2 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. Thi...

PT-2025-8706 · Pixelite · Events Manager

Name of the Vulnerable Software and Affected Versions: Events Manager versions through 6.6.4.1 Description: The issue is related to a Missing Authorization vulnerability in Pixelite Events Manager, which allows exploitation due to incorrectly configured access control security levels...

Amazon Linux 2023 : git-lfs (ALAS2023-2025-851)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-851 advisory. Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2025-850)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-850 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError is going to assume the active request exists when envoy.loadshedpoints.http1serverabortdispatch...

PT-2025-8491 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.18.0-rc7+ Description: A double hook unregistration issue in the netfilter nf tables component has been identified. The nft release hooks function is called from the pre netns exit path, which unregisters the...

CVE-2025-27219 - Denial of Service in CGI::Cookie.parse

There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem. Details CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into t...

CVE-2025-27221 - userinfo leakage in URI#join, URI#merge and URI#+.

There is a possibility for userinfo leakage by in the uri gem. This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem. Details The methods URIjoin, URImerge, and URI+ retained userinfo, such as user:password, even after the host is replaced. Whe...

CVE-2024-11955

A vulnerability was found in GLPI up to 10.0.17. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument redirect leads to open redirect. The attack can be launched remotely. The exploit has been...

CVE-2024-11955 GLPI index.php redirect

A vulnerability was found in GLPI up to 10.0.17. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument redirect leads to open redirect. The attack can be launched remotely. The exploit has been...

CVE-2024-11955

GLPI 10.0.x vulnerable up to 10.0.17. Affected functionality: an interaction with /index.php via a manipulated redirect parameter enabling an open redirect. Exploitation described as remote and publicly disclosed. Remediation: upgrading to 10.0.18 addresses this issue (per initial CVE description...

Hitachi Energy MACH PS700

SUMMARY Hitachi Energy is aware of a vulnerability in third party component Intel Chipset Device Software, that affects MACH PS700 v2 product versions listed in this document. Authenticated malicious clients successfully exploiting this vulnerability could escalate the privilege to cause...

Rockwell Automation PowerFlex 755

RISK EVALUATION Successful exploitation of this vulnerability could result in exposure of sensitive data. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system...

CVE-2025-1644

Benner ModernaNet (up to 1.2.0) contains a cross-site request forgery vulnerability in an unknown function of the file /DadosPessoais/SG_Gravar, triggered by manipulating the idItAg parameter. The issue can be exploited remotely and results in CSRF without user interaction assumptions beyond the ...

CVE-2025-1643

A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of the file /DadosPessoais/SGAlterarSenha. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.1....

CVE-2025-1643

Benner ModernaNet (versions up to 1.1.0) contains a cross-site request forgery vulnerability in the /DadosPessoais/SG_AlterarSenha handling. The issue could be triggered remotely and affects user-initiated actions leading to unauthorized state changes. Remediation: upgrade to version 1.1.1, which...

CVE-2025-1642 Benner ModernaNet GetImageMedico resource injection

A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the argument fooId leads to improper control of resource identifiers. The attack can be initiat...

CVE-2025-1642

Benner ModernaNet up to version 1.1.0 contains a vulnerability in the file /AGE0000700/GetImageMedico?fooId=1 where manipulation of the fooId argument leads to improper control of resource identifiers. The issue can be triggered remotely and affects unknown code paths; upgrading to version 1.1.1 ...