2731 matches found
Security Bulletin: IBM Storage Ceph is vulnerable to Use After Free in the RHEL UBI (CVE-2024-25062)
Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2024-25062 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2024-25062 DESCRIPTION: An issue was discovered in libxml2 before 2.11.7 and 2.12.x...
Security Bulletin: IBM Storage Ceph is vulnerable to Insecure Inherited Permissions in the RHEL UBI (CVE-2024-22365)
Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2024-22365 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2024-22365 DESCRIPTION: linux-pam aka Linux PAM before 1.6.0 allows attackers to cause...
Security Bulletin: IBM Storage Ceph is vulnerable to Cross-site Scripting in Jinja2 (CVE-2024-22195)
Summary Jinja2 is used by IBM Storage Ceph and by the RHEL UBI in multiple components. CVE-2024-22195 This bulletin identifies the steps to take to address the vulnerability in Jinja2. Affected components include nvme, grafana, keepalived, haproxy, promtail. snmp, ansible, fence-agents, rust...
Security Bulletin: IBM Storage Ceph is vulnerable to improper handling of JavaScript whitespace in golang in the RHEL UBI (CVE-2023-24540)
Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-24540 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2023-24540 DESCRIPTION: Not all valid JavaScript whitespace characters are considered ...
Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by arbitrary code execution
Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by arbitrary code execution CVE-2025-36038 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...
Security Bulletin: IBM InfoSphere DataStage Flow Designer is vulnerable due to cleartext transmission of sensitive information (CVE-2025-36034)
Summary A disclosure of sensitive information vulnerability in InfoSphere DataStage Flow Designer was addressed. Vulnerability Details CVEID:CVE-2025-36034 DESCRIPTION: IBM InfoSphere DataStage Flow Designer discloses sensitive user information in API requests in clear text that could be...
Exploit for CVE-2025-1974
IngressNightmare: CVE-2025-1974 - Unauthenticated Remote Code...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to nodejs in the management console (CVE-2021-3807)
Summary Node.js is used by IBM Storage Fusion Data Foundation in the management console and is vulnerable to a denial of service. This bulletin identifies the steps to take to address the vulnerability in IBM Storage Fusion Data Foundation. CVE-2021-3807. Vulnerability Details CVEID:CVE-2021-3807...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to a denial of service via Node.js braces module (CVE-2024-4068)
Summary Node.js braces module is used by IBM Storage Fusion Data Foundation as part of CVE-2024-4068 which may lead denial of services. This bulletin identifies the steps to take to address the vulnerability in IBM Storage Fusion Data Foundation. Vulnerability Details CVEID:CVE-2024-4068...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to CVE-2022-46175
Summary JSON5 is used by IBM Storage Fusion Data Foundation in the management-console and could allow a remote authenticated attacker to execute arbitrary code on the systemas part of CVE-2022-46175. This bulletin identifies the steps to take to address the vulnerability in IBM Storage Fusion Dat...
Security Bulletin: IBM WebSphere Application Server is affected by arbitrary code execution (CVE-2025-36038)
Summary IBM WebSphere Application Server is affected by arbitrary code execution. Vulnerability Details CVEID:CVE-2025-36038 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects...
CVE-2025-52572 Hikka vulnerable to RCE through dangling web interface
Hikka, a Telegram userbot, has vulnerability affects all users on all versions of Hikka. Two scenarios are possible. 1. Web interface does not have an authenticated session: attacker can use his own Telegram account to gain RCE to the server by authorizing in the dangling web interface. 2. Web...
Kibana 7.17.29, 8.17.8, 8.18.3, 9.0.3 Security Update (ESA-2025-10)
Kibana Open Redirect ESA-2025-10 URL redirection to an untrusted site 'Open Redirect' in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. Affected Versions: Kibana versions up to and including 7.17.28, 8.0.0 up to and including...
CVE-2025-6032
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack. Mitigation Download the VM image manually with another tool that verifies the TLS certificate and...
CVE-2025-23172
The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and "Test Webhook" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged ...
Amazon Linux 2023 : aws-kinesis-agent (ALAS2023-2025-1024)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1024 advisory. Jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in...
Exploit for PHP Remote File Inclusion in Wpplugins Hide_My_Wp_Ghost
CVE-2025-26909 Vulnerability Scanner A Python-based scanner a...
Leaky Thoughts: Large Reasoning Models Are Not Private Thinkers
We study privacy leakage in the reasoning traces of large reasoning models used as personal agents. Unlike final outputs, reasoning traces are often assumed to be internal and safe. We challenge this assumption by showing that reasoning traces frequently contain sensitive user data, which can be...
Security Bulletin: IBM InfoSphere Information Server is vulnerable to denial of service (CVE-2025-3221)
Summary A denial of service vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2025-3221 DESCRIPTION: IBM InfoSphere Information Server could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request...