PT-2025-30150 · Tenda · Tenda Fh451

Name of the Vulnerable Software and Affected Versions: Tenda FH451 version 1.0.0.9 Description: A critical issue exists in Tenda FH451 version 1.0.0.9 related to a stack-based buffer overflow. The vulnerability is located in the fromSetIpBind function within the /goform/SetIpBind file. The page...

PT-2025-29686

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.1.1551 Description Vim, an open-source command-line text editor, contains a path traversal issue within its zip.vim plugin. This issue allows overwriting of arbitrary files when opening specially crafted zip archives...

PT-2025-29554 · Riverbed Technology · Riverbed Steelcentral Netprofiler +1

Name of the Vulnerable Software and Affected Versions: Riverbed SteelCentral NetProfiler and NetExpress version 10.8.7 Description: An authenticated multi-stage remote code execution issue exists. A SQL injection vulnerability in the /api/common/1.0/login endpoint can be exploited to create a new...

PT-2025-29557 · Ipfire · Ipfire

Name of the Vulnerable Software and Affected Versions: IPFire versions prior to 2.19 Core Update 101 Description: A remote command execution issue exists in IPFire due to a flaw in the proxy.cgi CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in...

PT-2025-29673 · Cyberark · Secrets Manager +1

Name of the Vulnerable Software and Affected Versions: CyberArk Secrets Manager, Self-Hosted versions prior to 13.5.1 and 13.6.1 Conjur OSS versions prior to 1.22.1 Description: An attacker with access to a misconfigured network device routing traffic from Secrets Manager to AWS can redirect...

PT-2025-29571 · Dassault Systèmes · Solidworks Desktop +1

Name of the Vulnerable Software and Affected Versions: SOLIDWORKS eDrawings versions prior to SOLIDWORKS Desktop 2025 Description: A Use After Free issue exists in the CATPRODUCT file reading procedure. This could allow an attacker to execute arbitrary code when opening a specially crafted...

Tuesday, July 15, 2025 Security Releases

Tuesday, July 15, 2025 Security Releases Security releases available Updates are now available for the 24.x, 22.x, 20.x Node.js release lines for the following issues. Windows Device Names CON, PRN, AUX Bypass Path Traversal Protection in path.normalize CVE-2025-27210 - high An incomplete fix has...

PT-2025-29540 · Protns · Actadur

Name of the Vulnerable Software and Affected Versions: ActADUR versions 2.0.1.9 through 2.0.1.9 Description: The ActADUR local server product, developed and maintained by ProTNS, allows for Remote Code Inclusion on host systems. The vulnerability has been rated as critical and includes issues suc...

PT-2025-29569 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 7.6.4 DSpace versions prior to 8.2 DSpace versions prior to 9.1 Description: DSpace is a repository application providing access to digital resources. A path traversal issue exists during the import of an archive in...

PT-2025-29580 · Jetbrains · Jetbrains Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2025.2.86069 JetBrains YouTrack versions prior to 2024.3.85077 JetBrains YouTrack versions prior to 2025.1.86199 Description: An issue exists in JetBrains YouTrack that allows for email spoofing through an...

CVE-2025-53824

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the editarpermissoes.php endpoint of the WeGIA application prior to version 3.4.4. This vulnerability allows attackers to...

CVE-2025-53839 DRACOON Branding Service vulnerable to Cross-site Scripting

DRACOON is a file sharing service, and the DRACOON Branding Service allows customers to customize their DRACOON interface with their brand. Versions of the DRACOON Branding Service prior to 2.10.0 are vulnerable to cross-site scripting. Improper neutralization of input from administrative users...

CVE-2025-53015

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue...

CVE-2025-53019 ImageMagick has Memory Leak in magick stream

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's magick stream command, specifying multiple consecutive %d format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and...

CVE-2025-53015 ImageMagick has XMP profile write that triggers hang due to unbounded loop

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue...

CVE-2025-53015

CVE-2025-53015 affects ImageMagick prior to 7.1.2-0, where a specific XMP file conversion command can cause an unbounded loop in the WriteImage path, triggering an infinite hang (Denial of Service). The PoC demonstrates the hang via a command like magick hang a.mng. Impact is described as a hang ...

CVE-2025-53015 ImageMagick has XMP profile write that triggers hang due to unbounded loop

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue...

CVE-2025-53014 ImageMagick has Heap Buffer Overflow in InterpretImageFilename

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the InterpretImageFilename function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processi...

CVE-2025-53014 ImageMagick has Heap Buffer Overflow in InterpretImageFilename

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the InterpretImageFilename function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processi...

Denial Of Service (DoS)

org.apache.tomcat:tomcat-catalina is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of multipart upload size limits due to an integer overflow in certain multipart upload configurations, which can bypass configured size restrictions and lead to denial of servic...