Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server is vulnerable to server-side request forgery (CVE-2025-27907)

Summary The security issue described in CVE-2025-27907 has been identified in the WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

PT-2025-18314 · Opencti · Opencti

Name of the Vulnerable Software and Affected Versions: OpenCTI versions 6.4.8 through 6.4.9 Description: The issue allows a user to bypass allow/deny lists and modify attributes that are intended to be unmodifiable. This includes toggling the external flag on/off, changing the own token value for...

PT-2025-18248 · Unknown · Phpgurukul Pre-School Enrollment System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Pre-School Enrollment System version 1.0 Description: A critical issue was found in the PHPGurukul Pre-School Enrollment System, affecting some unknown functionality of the file /admin/edit-teacher.php. The manipulation of the...

PT-2025-18268 · Abb · Abb Automation Builder

Name of the Vulnerable Software and Affected Versions: ABB Automation Builder versions prior to 2.8.0 Description: The issue is related to an incorrect permission assignment for critical resources in ABB Automation Builder. Recommendations: For versions prior to 2.8.0, update to version 2.8.0 or...

PT-2025-18310 · Anc · Anc

Name of the Vulnerable Software and Affected Versions: ANC software versions 1.1.4 and earlier Description: The issue allows an authenticated attacker to bypass the old password check in the password change form via a web HMI. Recommendations: For ANC software versions 1.1.4 and earlier, update t...

PT-2025-19993

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.24.3 Go versions prior to 1.23.9 Description The issue concerns a security fix in the os package. Recommendations For versions prior to 1.24.3, update to version 1.24.3 to resolve the issue. For versions prior to 1.23.9,...

CVE-2025-4091

Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 13...

BELL-CVE-2025-46646

Bulletin has no description...

CVE-2025-46329 Snowflake Connector for C/C++ inserts client-side encryption key in DEBUG logs

libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage durin...

PT-2025-18210 · Yeswiki · Yeswiki

Name of the Vulnerable Software and Affected Versions: YesWiki versions prior to 4.5.4 Description: The issue allows a malicious user to create and download site backups without authentication. This could result in a malicious attacker making numerous requests to create archives and fill up the...

PT-2025-18209 · Auth0 · Auth0 Next.Js Sdk

Name of the Vulnerable Software and Affected Versions: Auth0 Next.js SDK versions 4.0.1 through 4.5.0 Description: The issue arises from the failure to invoke .setExpirationTime when generating a JWE token for the session in the Auth0 Next.js SDK. This results in the JWE not containing an interna...

PT-2025-18213 · Unknown · Khc-Invitation-Automation

Name of the Vulnerable Software and Affected Versions: KHC-INVITATION-AUTOMATION version 1.2 Description: The issue concerns a GitHub automation script where user data, including email addresses and Discord usernames, were exposed in API responses without proper access controls. This allowed...

PT-2025-18164 · Unknown · Theater Seat Booking System

Name of the Vulnerable Software and Affected Versions: Theater Seat Booking System version 1.0 Description: A critical issue has been found in the Theater Seat Booking System, affecting the cancel function. The manipulation of the cancelcustomername argument leads to a stack-based buffer overflow...

PT-2025-18170 · Ibm · Ibm Operational Decision Manager

Name of the Vulnerable Software and Affected Versions: IBM Operational Decision Manager versions 8.11.0.1 through 9.0.0.1 Description: The issue allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to...

Cross-site Scripting (XSS)

Laravel Starter is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient input sanitization that allowing users to inject malicious JavaScript code into the tag name field...

MAL-2025-3504 Malicious code in turbo-bike-inspector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b2b7e282a4f78a18dbc7c28f2200bea91788bc176c9f76173a34af8ead206dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-18034 · 104 · Ehrms

Name of the Vulnerable Software and Affected Versions: eHRMS from 104 Corporation affected versions not specified Description: The issue allows unauthenticated remote attackers to execute arbitrary JavaScript codes in a user's browser through phishing attacks. This is a Reflected Cross-site...

CVE-2025-2185

ALBEDO Telecom Net.Time - PTP/NTP clock Serial No. NBC0081P software release 1.4.4 is vulnerable to an insufficient session expiration vulnerability, which could permit an attacker to transmit passwords over unencrypted connections, resulting in the product becoming vulnerable to interception...

PT-2025-17969 · Nasa · Nasa Cryptolib

Name of the Vulnerable Software and Affected Versions: NASA CryptoLib versions prior to 1.3.2 Description: The issue is related to the OTAR crypto function in NASA CryptoLib, where the returned status is not checked, potentially leading to spacecraft hijacking. Recommendations: For NASA CryptoLib...

PT-2025-17972 · Nasa · Nasa Cryptolib

Name of the Vulnerable Software and Affected Versions: NASA CryptoLib versions prior to 1.3.2 Description: The issue is related to the key state not being checked before use in NASA CryptoLib, potentially leading to spacecraft hijacking. Recommendations: For NASA CryptoLib versions prior to 1.3.2...