CVE-2025-8898 Taxi Booking Manager for Woocommerce | E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover

The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.0. This is due to the plugin not properly validating a user's capabilities prior to updating a plugin setting or their identit...

CVE-2025-8898

CVE-2025-8898 concerns the WordPress plugin “Taxi Booking Manager for Woocommerce | E-cab”. The vulnerability allows privilege escalation via account takeover in all versions up to and including 1.3.0 (Wordfence notes 1.3.0; PT Security references 1.3.1+ as the fix). The root cause is insufficien...

CVE-2025-3671

CVE-2025-3671 concerns the WPGYM WordPress plugin (Gym Management System) with a Local File Inclusion vulnerability exploitable via the vulnerable parameter “page.” According to the primary sources, this affects all versions up to 67.7.0 and requires authentication at Subscriber level or higher; ...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a crash when drm/imagination hard resets the GPU, which may result in clocks not being enabled...

CVE-2025-54791

OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been...

CVE-2025-50594

An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account password...

Linux Distros Unpatched Vulnerability : CVE-2025-21892

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/mlx5: Fix the recovery flow of the UMR QP This patch addresses an issue in the recovery flow of the UMR QP, ensuring tasks do not get stuck, as highlighted...

Linux Distros Unpatched Vulnerability : CVE-2022-50041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ice: Fix call trace with null VSI during VF reset During stress test with attaching and...

Linux Distros Unpatched Vulnerability : CVE-2022-49906

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Free rwi on reset success Free the rwi structure in the event that the last rwi in...

Linux Distros Unpatched Vulnerability : CVE-2025-23157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: venus: hfiparser: add check to avoid out of bound access There is a possibility that initcodecs is invoked multiple times during manipulated payload from...

Linux Distros Unpatched Vulnerability : CVE-2024-35968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: pdscore: Fix pdsccheckpcihealth function to use work thread When the driver notices fwstatus...

MAL-2025-25151 Malicious code in leo-password-reset-service (npm)

The package leo-password-reset-service was found to contain malicious code...

Malicious code in @malware-test-aulos-reset-wiles-nodus/test-mlw3-aulos-reset-wiles-nodus (npm)

The package @malware-test-aulos-reset-wiles-nodus/test-mlw3-aulos-reset-wiles-nodus was found to contain malicious code...

Malicious code in leo-password-reset-service (npm)

The package leo-password-reset-service was found to contain malicious code...

Malicious code in test-mlw2-reset-parry (npm)

The package test-mlw2-reset-parry was found to contain malicious code...

MAL-2025-36109 Malicious code in test-mlw2-reset-parry (npm)

The package test-mlw2-reset-parry was found to contain malicious code...

CVE-2025-8310

Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password...

Apache Tomcat 9.0.0.M1 < 9.0.108

The version of Tomcat installed on the remote host is prior to 9.0.108. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.108security-9 advisory. - Tomcat's HTTP/2 implementation was vulnerable to the made you reset attack. The denial of service typically...

FreeBSD : www/varnish7 -- Denial of Service in HTTP/2 (e2d49973-785a-11f0-a1c0-0050569f0b83)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e2d49973-785a-11f0-a1c0-0050569f0b83 advisory. Varnish Development Team reports: A denial of service attack can be performed on Varnish Cache servers...

swift-nio-http2 affected by HTTP/2 MadeYouReset vulnerability

The HTTP/2 MadeYouReset vulnerability has a mild effect on swift-nio-http2. swift-nio-http2 mostly protects against MadeYouReset by using a number of existing denial-of-service prevention patterns that we added in response to the RapidReset vulnerabilities. The result is that servers are not...