12577 matches found
CVE-2025-49586
XWiki is affected by CVE-2025-49586, a remote code execution (RCE) vulnerability in which any user with edit rights on at least one App Within Minutes application can obtain programming rights and execute code by editing the application. The flaw is fixed in XWiki releases 17.0.0, 16.4.7, and 16....
RHSA-2025:9043 Red Hat Security Advisory: golang security update
Bulletin has no description...
RHSA-2025:9019 Red Hat Security Advisory: containernetworking-plugins security update
Bulletin has no description...
PT-2025-25438 · Xwiki · Xwiki
Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 16.4.7 XWiki versions prior to 16.10.3 XWiki versions prior to 17.0.0 Description: The issue allows any XWiki user with edit rights on at least one App Within Minutes application to obtain programming rights and perfor...
PT-2025-25425 · Drupal · Drupal Bookable Calendar
Name of the Vulnerable Software and Affected Versions: Drupal Bookable Calendar versions 0.0.0 through 2.2.12 Description: The issue is related to a Missing Authorization vulnerability in Drupal Bookable Calendar, which allows Forceful Browsing. Recommendations: For versions 0.0.0 through 2.2.12,...
JVN#27937557: Multiple vulnerabilities in RICOH Streamline NX PC Client
RICOH Streamline NX PC Client provided by Ricoh Company, Ltd. contains multiple vulnerabilities listed below. External control of file name or path CWE-73 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N Base Score 6.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Base Score 6.5...
PT-2025-29178 · Advantech · Iview
Name of the Vulnerable Software and Affected Versions: Advantech iView versions prior to 5.7.05 build 7057 Description: A vulnerability allows a reflected cross-site scripting XSS attack. By manipulating specific parameters, an attacker could execute unauthorized scripts in a user’s browser,...
PT-2025-25445 · Dell · Dell Controlvault3 +1
Name of the Vulnerable Software and Affected Versions: Dell ControlVault3 versions prior to 5.15.10.14 Dell ControlVault3 Plus versions prior to 6.2.26.36 Description: An out-of-bounds read vulnerability exists in the cv send blockdata functionality. A specially crafted ControlVault API call can...
PT-2025-25400 · Ricoh · Ricoh Streamline Nx V3 Pc Client
Name of the Vulnerable Software and Affected Versions: RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0 Description: An issue exists where an attacker can control file names or paths, allowing arbitrary files in the file system to be overwritten with log data if a specially crafted...
PT-2025-25446 · Dell · Dell Controlvault3 +1
Name of the Vulnerable Software and Affected Versions: Dell ControlVault3 versions prior to 5.15.10.14 Dell ControlVault3 Plus versions prior to 6.2.26.36 Description: A stack-based buffer overflow vulnerability exists in the securebio identify functionality. A specially crafted malicious cv obje...
PT-2025-25436 · Unknown · Xwiki Platform
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 10.9 through 16.4.6 XWiki Platform versions 16.5.0-rc-1 through 16.10.2 XWiki Platform versions 17.0.0-rc-1 Description: The issue affects XWiki, a generic wiki platform, where an attacker can access the title of every...
PT-2025-25429 · Drupal · Drupal Etracker
Name of the Vulnerable Software and Affected Versions: Drupal etracker versions 0.0.0 through 3.0.x Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to perform Cross-Site Scripting XSS...
PT-2025-25428 · Drupal · Drupal Simple Klaro
Name of the Vulnerable Software and Affected Versions: Drupal Simple Klaro versions 0.0.0 through 1.10.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Cross-Site Scripting XSS attacks...
PT-2025-25382 · WordPress · Wp Travel Engine
Name of the Vulnerable Software and Affected Versions: The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress versions up to, and including, 6.5.1 Description: The issue is related to a missing capability check on the delete package function, allowing...
PT-2025-25427 · Drupal · Drupal Simple Klaro
Name of the Vulnerable Software and Affected Versions: Drupal Simple Klaro versions 0.0.0 through 1.10.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Cross-Site Scripting XSS attacks...
PT-2025-29175 · Advantech · Advantech Iview
Name of the Vulnerable Software and Affected Versions: Advantech iView versions prior to 5.7.05 build 7057 Description: A reflected cross-site scripting XSS issue exists. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially...
RHSA-2025:8981 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
Bulletin has no description...
RHSA-2025:8982 Red Hat Security Advisory: grafana-pcp security update
Bulletin has no description...