PT-2025-20607 · Totolink · Totolink T10 +6

Name of the Vulnerable Software and Affected Versions: TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R versions 4.1.8cu.5241 B20210927 Description: A critical vulnerability exists in the CloudACMunualUpdate function of the /cgi-bin/cstecgi.cgi file in the affected devices. The...

CVE-2025-37883 s390/sclp: Add check for get_zeroed_page()

In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Add check for getzeroedpage Add check for the return value of getzeroedpage in sclpconsoleinit to prevent null pointer dereference. Furthermore, to solve the memory leak caused by the loop allocation, add a free helper...

PT-2025-20555 · Enersys · Enersys Ampa

Name of the Vulnerable Software and Affected Versions: EnerSys AMPA versions 22.09 and prior Description: The issue allows for command injection, which can lead to privileged remote shell access. Recommendations: For versions 22.09 and prior, update to a version later than 22.09 to resolve the...

DLA-4160-1 libbson-xs-perl - security update

Bulletin has no description...

PT-2025-20474 · Sparx Systems · Sparx Systems Pro Cloud Server

Name of the Vulnerable Software and Affected Versions: Sparx Systems Pro Cloud Server versions earlier than 6.0.165 Description: The issue is related to an Improper Input Validation vulnerability in the WebEA model search field of Sparx Systems Pro Cloud Server, which allows Cross-Site Scripting...

PT-2025-22457 · Manageengine · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: ManageEngine ADAudit Plus versions 8510 and prior Description: The issue is related to authenticated SQL injection when fetching service account audit data. Recommendations: For ManageEngine ADAudit Plus versions 8510 and prior, update to a...

PT-2025-24423 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior Description: The issue concerns an authenticated SQL injection vulnerability in the Service Account Auditing reports of the affected software. Recommendations: For Zohocorp ManageEngi...

GHSA-MCRW-746G-9Q8H Trix vulnerable to Cross-site Scripting on copy & paste

Impact The Trix editor, in versions prior to 2.1.15, is vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized...

Trix vulnerable to Cross-site Scripting on copy & paste

Impact The Trix editor, in versions prior to 2.1.15, is vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized...

GHSA-7VRX-9684-XRF2 Craft CMS stores arbitrary content provided by unauthenticated users in session files

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at...

PT-2025-20385 · Rapid7 · Rapid7 Corporate Website

Name of the Vulnerable Software and Affected Versions: Rapid7 Corporate Website versions prior to May 2nd 2025 Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability allows an attacker to redirect users to a...

PT-2025-20426 · Ibm · Ibm Cics Tx Standard +1

Name of the Vulnerable Software and Affected Versions: IBM CICS TX Standard versions 11.1 IBM CICS TX Advanced versions 10.1 through 11.1 Description: The issue is due to the failure to handle DNS return requests by the gethostbyname function, which could allow a local user to execute arbitrary...

DLA-4157-1 request-tracker4 - security update

Bulletin has no description...

PT-2025-20367 · Real Time Innovations · Rti Connext Professional

Name of the Vulnerable Software and Affected Versions: RTI Connext Professional Core Libraries versions 4.5 through 6.1.2.22 RTI Connext Professional Core Libraries versions 7.0.0 through 7.3.0.6 RTI Connext Professional Core Libraries versions 7.4.0 through 7.4.x Description: The issue is a Buff...

PT-2025-20425 · Ibm · Ibm Cics Tx Standard +1

Name of the Vulnerable Software and Affected Versions: IBM CICS TX Standard versions 11.1 IBM CICS TX Advanced versions 10.1 through 11.1 Description: The issue is due to the failure to handle DNS return requests by the gethostbyaddr function, which could allow a local user to execute arbitrary...

PT-2025-20380

Name of the Vulnerable Software and Affected Versions AP Page Builder versions prior to 4.0.0 Description The issue is an Absolute Path Traversal vulnerability that could allow an unauthenticated remote user to modify the product item path within the config JSON file, allowing them to read any fi...

PT-2025-20427 · Ibm · Ibm Cics Tx Standard +1

Name of the Vulnerable Software and Affected Versions: IBM CICS TX Standard version 11.1 IBM CICS TX Advanced versions 10.1 through 11.1 Description: The issue allows a local user to execute arbitrary code on the system due to the unsafe use of the gets function. Recommendations: For IBM CICS TX...

Rack has an Unbounded-Parameter DoS in Rack::QueryParser

Summary Rack::QueryParser parses query strings and application/x-www-form-urlencoded bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. Details The vulnerability arises because...

RLSA-2024:4245 Moderate: python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Cisco IOS XE Wireless Controller Software Arbitrary File Upload Vulnerability

A vulnerability in the Out-of-Band Access Point AP Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. Th...