BAE Systems SOCET GXP 安全漏洞

BAE Systems SOCET GXP is a high-end geographic information image analysis and mapping software from BAE Systems. A security vulnerability exists in BAE Systems SOCET GXP prior to version 4.6.0.2, which originates from an unauthenticated request from the SOCET GXP Job Status Service, and could cau...

PT-2025-43989

Name of the Vulnerable Software and Affected Versions BAE SOCET GXP versions prior to 4.6.0.2 Description The SOCET GXP Job Status Service lacks Cross-Site Request Forgery CSRF protections. An attacker could potentially trick a legitimate user into unknowingly submitting requests to the Job Statu...

CVE-2025-54969

An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not implement CSRF protections. An attacker who social engineers a valid user into clicking a malicious link or visiting a malicious website may be able to submit requests to the Job Status Service...

CVE-2025-54970

BAE Systems SOCET GXP prior to version 4.6.0.2 contains a vulnerability in the Job Status Service where requests are not authenticated. In affected configurations, remote or local users may abort jobs or read information without the job owner’s permissions. The issue is documented across multiple...

PT-2025-43993

Name of the Vulnerable Software and Affected Versions BAE SOCET GXP versions prior to 4.6.0.2 Description An XSS issue exists in the SOCET GXP Job Status Service. The service does not properly sanitize the job ID parameter before using it in the job status page. An attacker may be able to execute...

Linux Distros Unpatched Vulnerability : CVE-2025-39980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nexthop: Forbid FDB status change while nexthop is in a group The kernel forbids the creation of non-FDB nexthop groups with FDB nexthops: ip nexthop add id 1 v...

CVE-2025-54965

An XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not properly sanitize the job ID parameter before using it in the job status page. An attacker who is able to social engineer a user into clicking a malicious link may be able to execute arbitrary...

WordPress plugin Tutor LMS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

CVE-2025-12134

The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updatepopupstatus function in all versions up to, and including, 2.3.11. This...

CVE-2025-12095

creationtimestamp| type| source ---|---|--- 2025-10-25 07:35:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3yuvhnugr2o...

CVE-2025-8413

creationtimestamp| type| source ---|---|--- 2025-10-25 07:20:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3yu2mairm2q...

CVE-2025-11564 Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it...

WordPress Tutor LMS plugin <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update vulnerability

Missing Authorization to Unauthenticated Payment Status Update vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Tutor LMS versions = 3.8.3...

CVE-2025-60553

creationtimestamp| type| source ---|---|--- 2025-10-24 17:05:03+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115430228079449533 2025-10-24 21:55:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3xuiiqmkr2o 2025-10-25 10:31:30+00:00| seen|...

CVE-2025-60563

creationtimestamp| type| source ---|---|--- 2025-10-24 17:05:03+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115430228080640259...

CVE-2025-60559

creationtimestamp| type| source ---|---|--- 2025-10-24 17:05:03+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115430228079633034...

CVE-2025-60548

creationtimestamp| type| source ---|---|--- 2025-10-24 17:05:03+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115430228079944974 2025-10-24 21:50:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3xu7kdozv2o...

CVE-2025-60566

creationtimestamp| type| source ---|---|--- 2025-10-24 17:05:02+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115430228080552683...

CVE-2025-60564

creationtimestamp| type| source ---|---|--- 2025-10-24 17:05:02+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115430228081612773...

CVE-2025-40021 tracing: dynevent: Add a missing lockdown check on dynevent

In the Linux kernel, the following vulnerability has been resolved: tracing: dynevent: Add a missing lockdown check on dynevent Since dynamicevents interface on tracefs is compatible with kprobeevents and uprobeevents, it should also check the lockdown status and reject if it is set...