16950 matches found
PT-2025-30323 · Ibm · Ibm Cognos Analytics Mobile
Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics Mobile iOS versions 1.1.0 through 1.1.22 Description: IBM Cognos Analytics Mobile iOS may expose information due to the use of unencrypted network traffic. Recommendations: IBM Cognos Analytics Mobile iOS versions prior t...
MAL-2025-6033 Malicious code in @nytt/sass-utils (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6047 Malicious code in @toptal/picasso-form (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6041 Malicious code in @toptal/picasso-button (npm)
The package communicates with a domain associated with malicious activity...
Withdrawn Advisory: Thor can construct an unsafe shell command from library input.
Withdrawn Advisory This advisory has been withdrawn because the method described can only be used with arguments that are controlled by Thor, and an external attacker cannot access the functionality described in the body of the CVE. This link is maintained to preserve external references. Origina...
CVE-2025-54314
Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."...
CVE-2025-54314
CVE-2025-54314 is tied to Ruby’s Thor library. The IBM/endorsement bulletin confirms Thor versions before 1.4.0 can construct an unsafe shell command from library input. The vulnerability is mitigated by upgrading to Thor 1.4.0 or newer, as noted in official fixes; the supplier disputes the claim...
PT-2025-30167
Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.12.0 Description A vulnerability exists in thinkgem JeeSite up to version 5.12.0 related to cross-site scripting. The issue resides in the xssFilter function within the...
PT-2025-30163
Name of the Vulnerable Software and Affected Versions Thor versions prior to 1.4.0 Description Thor versions prior to 1.4.0 can construct an unsafe shell command from library input. Recommendations Update Thor to version 1.4.0 or later...
CVE-2025-54314
Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."...
CVE-2025-48965
Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtlsasn1storenameddata can trigger conflicting data with val.p of NULL but val.len greater than zero...
BELL-CVE-2025-38349
Bulletin has no description...
PT-2025-30138 · Jinher Oa · Jinher Oa
Name of the Vulnerable Software and Affected Versions: Jinher OA version 1.1 Description: A vulnerability exists in the processing of the XmlHttp.aspx file, leading to XML external entity reference XXE. This issue can be exploited remotely. The exploit has been publicly disclosed. Recommendations...
CVE-2025-52166
Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to Administrator and access sensitive components and information...
CVE-2025-53901 Wasmtime has host panic with `fd_renumber` WASIp1 function
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...
CVE-2025-54073 mcp-package-docs vulnerable to command injection in several tools
mcp-package-docs is an MCP Model Context Protocol server that provides LLMs with efficient access to package documentation across multiple programming languages and language server protocol LSP capabilities. A command injection vulnerability exists in the mcp-package-docs MCP Server prior to the...
CVE-2025-54073 mcp-package-docs vulnerable to command injection in several tools
mcp-package-docs is an MCP Model Context Protocol server that provides LLMs with efficient access to package documentation across multiple programming languages and language server protocol LSP capabilities. A command injection vulnerability exists in the mcp-package-docs MCP Server prior to the...
Incorrect Permission Assignment For Critical Resource
org.apache.apisix:apisix-plugin-runner is vulnerable to Incorrect Permission Assignment for Critical Resource. The vulnerability is due to improper file permission settings caused by insecure local listening file permissions, allowing a local attacker to elevate privileges...
