CVE-2025-39664 Path-Traversal in report scheduler

Insufficient escaping in the report scheduler within Checkmk 2.4.0p13, 2.3.0p38, 2.2.0p46 and 2.1.0 EOL allows authenticated attackers to define the storage location of report file pairs beyond their intended root directory...

PT-2025-41389

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.4.0p13 Checkmk versions prior to 2.3.0p38 Checkmk versions prior to 2.2.0p46 Checkmk version 2.1.0 Description A flaw exists in the report scheduler of Checkmk that allows authenticated attackers to define the stora...

Checkmk 安全漏洞

Checkmk is an IT monitoring platform from Checkmk, Inc. A security vulnerability in Checkmk versions prior to 2.4.0p13, prior to 2.3.0p38, prior to 2.2.0p46, and version 2.1.0, which stems from insufficient escaping in the report scheduler, could allow an attacker to define the storage location o...

PT-2025-41437

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos Space versions prior to 24.1R4 Description An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' issue exists in Juniper Networks Junos Space. An attacker can inject script tags in the...

PT-2025-41424

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos Space versions prior to 24.1R4 Description An issue exists in Juniper Networks Junos Space that allows an attacker to inject script tags into the Generate Report page. When another user visits this page, the attacker can...

Juniper Networks Junos Space 跨站脚本漏洞

Juniper Networks Junos Space is a suite of network management solutions from Juniper Networks, Inc. The solution supports automated configuration, monitoring, and troubleshooting of devices and services throughout their lifecycle. A cross-site scripting vulnerability exists in Juniper Networks...

Juniper Networks Junos Space 跨站脚本漏洞

Juniper Networks Junos Space is a suite of network management solutions from Juniper Networks, Inc. The solution supports automated configuration, monitoring, and troubleshooting of devices and services throughout their lifecycle. A cross-site scripting vulnerability exists in Juniper Networks...

PT-2025-41341

Name of the Vulnerable Software and Affected Versions affected versions not specified Description A temporary denial of service can occur when processing an IOCTL call for image encoding. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

PT-2025-41436

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos Space versions prior to 24.1R4 Description An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' issue exists in Juniper Networks Junos Space. This allows an attacker to inject script tags...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the bfdx86elflatesizesections function. An attacker can cause a denial of service by triggering an out-of-bounds read through local access. Remediation A fix was pushed into the master branch but not yet published...

CVE-2025-42706

A logic error exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility LTV...

What to do when you click on a suspicious link

October is Cybersecurity Awareness Month, and as the tech-savvy friend or family member, people probably come to you for advice. One of the most common questions is: "I clicked a suspicious link. What do I do now?" Don't worry -- panic won't help, but a calm, step-by-step response will. Share thi...

CVE-2025-61997

OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise Banner image upload field. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the...

CVE-2025-61997

OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise Banner image upload field. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the...

CVE-2025-61996

OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perfo...

CVE-2025-61996

OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perfo...

OSV-2025-824 Use-of-uninitialized-value in JS_DefineProperty

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=449772271 Crash type: Use-of-uninitialized-value Crash state: JSDefineProperty buildbacktrace JSCallInternal...

OPEXUS FOIAXpress 安全漏洞

OPEXUS FOIAXpress is an information disclosure management software from OPEXUS Corporation. A security vulnerability exists in OPEXUS FOIAXpress versions prior to 11.13.3.0 that originates from an administrative user being able to inject JavaScript or other content into the annual report template...

CVE-2025-61996

CVE-2025-61996 affects OPEXUS FOIAXpress prior to 11.13.3.0. An administrative user can inject JavaScript or other content into the Annual Report Template, with injected content executed in other users’ sessions when they generate an Annual Report. This constitutes a stored XSS exposure that coul...

CVE-2025-61996 OPEXUS FOIAXpress stored XSS via annual report template

OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perfo...