Security Bulletin: AIX/VIOS is vulnerable to a denial of service (CVE-2025-49175, CVE-2025-49178) and an integer overflow (CVE-2025-49176, CVE-2025-49179)

Summary Vulnerabilities in Xorg X Server could cause a denial of service CVE-2025-49175, CVE-2025-49178 or an integer overflow CVE-2025-49176, CVE-2025-49179. Vulnerability Details CVEID:CVE-2025-49175 DESCRIPTION: A flaw was found in the X Rendering extension's handling of animated cursors. If a...

AIX is vulnerable to a denial of service (CVE-2025-49175 CVE-2025-49178) and an integer overflow (CVE-2025-49176 CVE-2025-49179)

IBM SECURITY ADVISORY First Issued: Mon Oct 13 08:46:48 CDT 2025 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/xorgadvisory4.asc Security Bulletin: AIX is vulnerable to a denial of service CVE-2025-49175, CVE-2025-49178 and an integer...

kernel: crypto: seqiv - Handle EBUSY correctly

In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of seqiv may specify...

HCL Unica Campaign 安全漏洞

HCL Unica Campaign is a marketing campaign management solution from HCL India. A security vulnerability exists in HCL Unica Campaign version 12.1.10, which originates from malicious script injection in HTTP requests and could lead to reflective cross-site scripting attacks...

PT-2025-41750

Name of the Vulnerable Software and Affected Versions HCL Unica Campaign version 12.1.10 Description The software is susceptible to Reflected Cross-Site Scripting XSS. An attacker can inject malicious script into an HTTP request. This script is then reflected unsafely in the server's response to...

AIX : Multiple Vulnerabilities (IJ55665)

The version of AIX installed on the remote host is prior to APAR IJ55665. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ55665 advisory. - A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflo...

Huawei EulerOS: Security Advisory for python-requests (EulerOS-SA-2025-2212)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AndSoft e-TMS Operating System Command Injection Vulnerability

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from an operating system command injection vulnerability, which is due to program misuse of parameter m in file /CLT/LOGINERRORFRM.ASP, and can be exploited by an attacker to execute operating system comman...

VulnCheck KEV: CVE-2024-9643

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via crafted HTTP requests. This issue appears similar to...

Huawei EulerOS: Security Advisory for python-requests (EulerOS-SA-2025-2244)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-10376

The Course Redirects for Learndash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4. This is due to missing nonce validation when processing form submissions on the settings page. This makes it possible for unauthenticated attackers to...

EUVD-2025-33823

The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via several wishlist AJAX functions due to missing validation on a user controlled key that is exposed when wishlists are shared. This makes it...

CVE-2025-10375 Web Accessibility By accessiBe <= 2.10 - Cross-Site Request Forgery

The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10. This is due to missing nonce validation on multiple AJAX actions including accessibesignup, accessibelogin, accessibelicensetrial, accessibemodifyconfig,...

CVE-2025-10375

The WordPress plugin Web Accessibility by accessiBe (plugins: accessibe) is affected by CVE-2025-10375. A CSRF vulnerability exists in all versions up to 2.10 due to missing nonce validation on multiple AJAX actions (accessibe_signup, accessibe_login, accessibe_license_trial, accessibe_modify_con...

EulerOS 2.0 SP11 : python-requests (EulerOS-SA-2025-2244)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties fo...

EulerOS 2.0 SP11 : python-requests (EulerOS-SA-2025-2212)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties fo...

PT-2025-41681

Name of the Vulnerable Software and Affected Versions Page Blocks plugin for WordPress versions prior to 1.1.1 Description The software is susceptible to Cross-Site Request Forgery CSRF. This is a result of inadequate or missing nonce validation within the admin process widget page change functio...

CVE-2025-59976

An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file...

CVE-2025-9868

Server-Side Request Forgery SSRF in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests...

CVE-2025-32916

Potential use of sensitive information in GET requests in Checkmk GmbH's Checkmk versions 2.4.0p13, 2.3.0p38, 2.2.0p46, and 2.1.0 EOL may cause sensitive form data to be included in URL query parameters, which may be logged in various places such as browser history or web server logs...