Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to a Race Condition vulnerability in Apache Tomcat [CVE-2024-56337]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Race Condition vulnerability in Apache Tomcat, due to a case insensitive file system, caused by improper default installation settings CVE-2024-56337. Apache Tomcat is used in our Speech microservices. This vulnerabilitiy has been...

CVE-2025-3501

A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended. Mitigation Use the correct TLS configuration and avoid using "--tls-hostname-verifier=any"...

CVE-2025-43961

In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment,...

CVE-2025-29769

libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't...

CVE-2024-38797

A flaw was found in EDK2. This vulnerability allows an attacker to cause an out-of-bounds read, potentially leading to a loss of integrity and/or availability via a crafted data pointer and length sent over an adjacent network. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-31124 Zitadel allows User Enumeration by loginname attribute normalization

Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report...

Exploit for CVE-2025-29927

CVE-2025-29927 - Next.js Middleware Authorization Bypass PoC...

Exploit for CVE-2025-29927

Testing script for CVE-2025-29927 Provided by CyberMaxx. CV...

How to Create a Scan in Perl to Identify Vulnerable SMTP Servers

This paper, written in Brazilian Portuguese, explains how to create a Perl script to identify vulnerable SMTP servers. In the context of application security, the author provides mitigation recommendations...

Detecting and Mitigating an Authorization Bypass Vulnerability in Next.js

...

CVE-2025-30346

A flaw was found in Varnish Cache and Varnish Enterprise. This vulnerability allows client-side desynchronization via crafted HTTP/1 requests. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprisi...

Detecting and Mitigating Apache Tomcat CVE-2025-24813

...

CVE-2023-22512

This High severity DoS Denial of Service vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this vulnerability allows an unauthenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely...

Detecting and Mitigating the Apache Camel Vulnerabilities

Akamai researchers have created detection scripts and additional details for the Apache Camel vulnerabilities CVE-2025-27636 and CVE-2025-29891...

GHSA-GGMG-XF9G-8CJX vulnerabilities

Vulnerabilities for packages: mysql...

GHSA-C9VC-XGH4-QH78 vulnerabilities

Vulnerabilities for packages: mysql...

YSA-2025-02 | Yubico

A low severity issue has been identified in YubiKeys versions 5.4.1 through 5.7.3 in the FIDO CTAP PIN/UV Auth Protocol Two implementation. These YubiKey versions use the 16 byte signature length from CTAP PIN/UV Auth Protocol One during the verification step, even when the 32 byte CTAP PIN/UV Au...

CVE-2025-22921

A flaw was found in FFmpeg. This vulnerability allows an attacker to trigger a segmentation violation via a crafted input file. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use...

CVE-2025-1371

A flaw was found in GNU elfutils. This vulnerability allows a NULL pointer dereference via the handledynamicsymtab function in readelf.c. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ea...

CVE-2024-52577

A flaw was found in Apache Ignite. This vulnerability allows remote code execution via specially crafted Ignite messages that bypass Class Serialization Filters. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Securit...