MAL-2025-3342 Malicious code in @sporta-technology/d11-web-components.progress-line (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3340 Malicious code in @sporta-technology/d11-web-components.popout (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3339 Malicious code in @sporta-technology/d11-web-components.pagination (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3301 Malicious code in @medibank-lib/medi-analytics (npm)

--- -= Per source details. Do not edit below this line.=-...

Stack Based Buffer Overflow

org.jsonschema2pojo, jsonschema2pojo-core is vulnerable to Stack-based buffer overflow. The vulnerability is due to improper input validation in the apply function of the SchemaRule.java file, allows attackers to exploit the function, leading to a stack-based buffer overflow...

PT-2025-17599 · Axis · Axis Camera Station Pro

Name of the Vulnerable Software and Affected Versions: AXIS Camera Station Pro affected versions not specified Description: A non-admin user can remove system files, causing a boot loop, by redirecting a file deletion when recording video. Recommendations: At the moment, there is no information...

PT-2025-17706 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 16.6 through 17.9.7 GitLab EE/CE versions 17.10 through 17.10.5 GitLab EE/CE versions 17.11 through 17.11.1 Description: An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing...

PT-2025-17656 · Drupal · Drupal Colorbox

Name of the Vulnerable Software and Affected Versions: Drupal Colorbox versions 0.0.0 through 2.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to perform Cross-Site Scripting XSS...

Q4 Investor Relations Platform 安全漏洞

Q4 Investor Relations Platform is an investor relations platform from Q4 Canada. A security vulnerability exists in Q4 Investor Relations Platform version v5.147.1.2, which stems from an unfiltered input to the SearchTerm parameter in the search function, and could lead to a cross-site scripting...

GO-2025-3621 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...

CVE-2025-3767 SQL Injection in Centreon BAM boolean KPI listing

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon BAM Boolean KPi Listing modules allows SQL Injection. This page is only accessible to authenticated users with high privileges. This issue affects Centreon BAM: from 24.10 before 24.10.1,...

PT-2025-17582 · Unknown · Dpmadirektpro

Name of the Vulnerable Software and Affected Versions: DPMAdirektPro version 4.1.5 Description: The issue allows for DLL Hijacking by placing a malicious DLL in a directory, which is then loaded by the application instead of the legitimate DLL. This results in the malicious DLL loading with the...

PT-2025-17481 · Zyxel · Zyxel Amg1302-T10B

Name of the Vulnerable Software and Affected Versions: Zyxel AMG1302-T10B version 2.00AAJC.16C0 Description: A path traversal vulnerability in the web management interface could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTT...

PT-2025-17535 · Crocoblock · Jetwoobuilder

Name of the Vulnerable Software and Affected Versions: JetWooBuilder versions 2.1.18 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For JetWooBuilder versions 2.1.18 an...

PT-2025-17528 · Caseproof · Memberpress

Name of the Vulnerable Software and Affected Versions: Memberpress versions 1.11.37 and earlier Description: The issue affects the Memberpress plugin, allowing for Reflected Cross-site Scripting XSS. This occurs due to improper neutralization of input during web page generation. Recommendations:...

PT-2025-17515 · Unknown · Vikrestaurants Table Reservations/Take-Away

Name of the Vulnerable Software and Affected Versions: VikRestaurants Table Reservations and Take-Away versions 1.3.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions 1.3.3 and earlier,...

PT-2025-17493 · Ferranfg · Mpl-Publisher

Name of the Vulnerable Software and Affected Versions: ferranfg MPL-Publisher versions n/a through 2.18.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17531 · David Gwyer +1 · Simple Sitemap – Create A Responsive Html Sitemap +1

Name of the Vulnerable Software and Affected Versions: Simple Sitemap – Create a Responsive HTML Sitemap versions 3.5.14 and earlier Description: A Missing Authorization issue affects the Simple Sitemap plugin. This issue may allow unauthorized access. Recommendations: For Simple Sitemap – Create...

CVE-2024-58250

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges...

PT-2025-17482 · Hitachi · Hitachi Ops Center Analyzer +1

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Common Services versions 10.0.0-00 through 11.0.0-04 Hitachi Ops Center Analyzer viewpoint OVF versions 10.0.0-00 through 11.0.0-04 Description: The issue is related to an authentication credentials leakage. This means that...