GHSA-7RX2-769V-HRWF HashiCorp Vault ldap auth method may not have correctly enforced MFA

Vault and Vault Enterprise’s “Vault” ldap auth method may not have correctly enforced MFA if usernameasalias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and...

RHSA-2025:13120 Red Hat Security Advisory: kernel security update

Bulletin has no description...

RHSA-2025:13104 Red Hat Security Advisory: python-cryptography security update

Bulletin has no description...

RHSA-2025:13029 Red Hat Security Advisory: kernel-rt security update

Bulletin has no description...

CVE-2025-6013

CVE-2025-6013 concerns Vault and Vault Enterprise’s LDAP authentication. The issue is a bypass of MFA enforcement when the LDAP method is configured with username_as_alias=true and a user has multiple equal CNs that include leading or trailing spaces, allowing a user to bypass alias-specific MFA ...

Advisory ROSA-SA-2025-2943

Software: openh264 2.1.1 OS: ROSA-CHROME unaffected versions = openh264-2.1.1-3 affected versions openh264-2.1.1-3 CVE-ID: CVE-2025-27091 BDU-ID: 2025-02022 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the decoding functions of the OpenH264 library is related to a buffer overflow in dynamic...

Advisory ROSA-SA-2025-2940

Software: exfatprogs 1.2.9 OS: ROSA-CHROME unaffected versions = exfatprogs-1.2.9-1 affected versions exfatprogs-1.2.9-1 CVE-ID: CVE-2023-45897 BDU-ID: 2024-03156 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the readfiledentryset function of the exfatprogs user-space utility is related to readi...

Advisory ROSA-SA-2025-2937

software: libxml2 2.9.14 OS: ROSA-CHROME unaffected versions = libxml2-2.9.14-9 affected versions libxml2-2.9.14-9 CVE-ID: CVE-2025-32414 BDU-ID: 2025-05199 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Python API component of the libxml2 library involves incorrect validation of the return val...

Advisory ROSA-SA-2025-2933

software: suricata 6.0.20 WASP: ROSA-CHROME unaffected versions = suricata-6.0.20-3 affected versions suricata-6.0.20-3 CVE-ID: CVE-2024-55626 BDU-ID: 2024-11374 CVE-Crit: LOW CVE-DESC.: A vulnerability in the BPF filter of the Suricata Intrusion Detection and Prevention System is related to an...

Advisory ROSA-SA-2025-2928

software: expat 2.7.1 OS: ROSA-CHROME unaffected versions = expat-2.7.1-1 affected versions expat-2.7.1-1 CVE-ID: CVE-2024-45490 BDU-ID: 2024-07004 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the libexpat XML parsing library is related to an improper restriction of a reference to an external...

Advisory ROSA-SA-2025-2922

software: kanboard 1.2.44 AXIS: ROSA-CHROME unaffected versions = kanboard-1.2.44-0.gitc07304.1-rosa2021.1 affected versions kanboard-1.2.44-0.gitc07304.1-rosa2021.1 CVE-ID: CVE-2024-51748 BDU-ID: 2024-10653 CVE-Crit: HIGH CVE-DESC.: A vulnerability in Kanboard project management software is...

Advisory ROSA-SA-2025-2923

software: util-linux 2.37.4 OS: ROSA-CHROME unaffected versions = util-linux-2.37.4-3 affected versions util-linux-2.37.4-3 CVE-ID: CVE-2024-28085 BDU-ID: 2024-02517 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the util-linux package of the Linux operating system is related to incorrect privile...

CVE-2025-54125

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can b...

PT-2025-32203

Name of the Vulnerable Software and Affected Versions Dell SupportAssist OS Recovery versions prior to 5.5.14.0 Description Dell SupportAssist OS Recovery contains a Creation of Temporary File With Insecure Permissions issue. A local authenticated attacker could potentially exploit this issue,...

PT-2025-32100 · Qualcomm · Smr Aug-2025 Release 1

Name of the Vulnerable Software and Affected Versions: versions prior to SMR Aug-2025 Release 1 Description: An improper access control issue exists in accessing a system device node. This allows local attackers to access the device identifier. Recommendations: Update to SMR Aug-2025 Release 1 or...

PT-2025-32209 · Dell · Dell Supportassist Os Recovery

Name of the Vulnerable Software and Affected Versions: Dell SupportAssist OS Recovery versions prior to 5.5.14.0 Description: Dell SupportAssist OS Recovery contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could...

PT-2025-32173 · Opentext · Opentext Advance Authentication

Name of the Vulnerable Software and Affected Versions: OpenText Advanced Authentication versions prior to 6.5.0 Description: A weakness exists in OpenText Advanced Authentication that allows a malicious browser plugin to record and replay the user authentication process, bypassing authentication...

PT-2025-32035 · WordPress · Cleverreach® Wp Plugin

Name of the Vulnerable Software and Affected Versions: CleverReach® WP plugin for WordPress versions through 1.5.20 Description: The CleverReach® WP plugin for WordPress is susceptible to time-based SQL Injection via the title parameter. Insufficient escaping of user-supplied input and inadequate...

PT-2025-32081 · WordPress · Request A Quote Form

Name of the Vulnerable Software and Affected Versions: Request a Quote Form plugin for WordPress versions prior to 2.5.3 Description: The Request a Quote Form plugin for WordPress is susceptible to Remote Code Execution due to improper validation of user input before it is used as a function name...

PT-2025-32229 · Suitecrm · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions 7.14.6 and 8.8.0 Description: SuiteCRM is an open-source Customer Relationship Management CRM software application. In versions 7.14.6 and 8.8.0, user-supplied input is not validated or sanitized before being passed to the...