Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to netty-handler-4.1.117.Final.jar CVE-2025-24970

Summary IBM Maximo Application Suite - Monitor Component is vulnerable to netty-handler-4.1.117.Final.jar CVE-2025-24970. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2025-24970 DESCRIPTION: Netty, an asynchronous, event-driven network...

PT-2025-20659 · Yangzongzhuan · Ruoyi-Vue

Name of the Vulnerable Software and Affected Versions: RuoYi-Vue versions up to 3.8.9 Description: A problem was found in the Password Handler component, affecting some unknown functionality of the files ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue. This issue leads to cleartext storage of...

Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch

Summary Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.This bulletin contains information regarding the vulnerability and its fixture...

Security Bulletin: VMware Tanzu Spring Framework could provide weaker than expected security, affects watsonx.data

Summary VMware Tanzu Spring Framework could provide weaker than expected security, caused by a flaw related to disallowedFields patterns in DataBinder is case insensitive. A remote attacker could exploit this vulnerability to launch further attacks on the system and this could affect watsonx.data...

CVE-2025-22246 - UAA Private Key Exposure | Cloud Foundry

Severity LOW Vendor CloudFoundry Foundation Versions Affected UAA Release: v77.21.0 to v77.31.0 CF Deployment: v45.1.0 to v48.11.0 Description Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. Affected Cloud Foundry Products and Versions...

Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to spring-context-6.1.11.jar CVE-2024-38820

Summary IBM Maximo Application Suite - Monitor Component is vulnerable to spring-context-6.1.11.jar CVE-2024-38820. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-38820 DESCRIPTION: VMware Tanzu Spring Framework could provide weaker...

Abnormal Network Behavior Detected (Low)

Abnormal network behavior by unexpected assets can indicate reconnaissance of the network by a potential attacker. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in IP

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of IP Vulnerability Details CVEID:CVE-2024-29415 DESCRIPTION: The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1 are...

UBUNTU-CVE-2025-37781

In the Linux kernel, the following vulnerability has been resolved: i2c: cros-ec-tunnel: defer probe if parent EC is not present When i2c-cros-ec-tunnel and the EC driver are built-in, the EC parent device will not be found, leading to NULL pointer dereference. That can also be reproduced by...

How to Test USB Device Driver Compatibility Using RDP Remote FX USB Redirection

To troubleshoot USB devices that may not function correctly using Citrix Generic USB Redirection. Such as devices that work correctly when redirected using Single User Desktop OS VDAs, but may not work correctly in Multiuser Server VDAs. A useful troubleshooting step is to test redirecting the...

Exploit for Unrestricted Upload of File with Dangerous Type in Aeropage Aeropage_Sync_For_Airtable

CVE-2025-3914 - Arbitrary File Upload in Aeropage Sync for A...

Security Bulletin: IBM InfoSphere Information Server is vulnerable due to insufficient session expiration (CVE-2024-22351)

Summary An insufficient session expiration vulnerability in InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2024-22351 DESCRIPTION: IBM InfoSphere Information Server does not invalidate session after logout which could allow an authenticated user to impersonate anothe...

CVE-2025-32964 ManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensions

ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 00bebea, when enabling a conflicting extension, a restricted extension would be automatically disabled even if the user did not hold the ManageWiki-restricted right. This issue has been patched in commit 00bebea. ...

CentralizedFirewall - Provides A Firewall Manager API Designed To Centralize And Streamline The Management Of Firewall Configurations

Firewall Manager API Project Installation Follow these steps to set up and run the API project: 1. Clone the Repository git clone https://github.com/adriyansyah-mf/CentralizedFirewall cd CentralizedFirewall 2. Edit the .env File Update the environment variables in .env according to your...

youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

Description This advisory follows the security advisory GHSA-79w7-vh3h-8g4j published by the yt-dlp/yt-dlp project to aid remediation of the issue in the ytdl-org/youtube-dl project. Vulnerability youtube-dl does not limit the extensions of downloaded files, which could lead to arbitrary filename...

Security Bulletin: IBM i is vulnerable to a database access denial of service caused by a database capabilities bypass restriction check [CVE-2024-52895].

Summary IBM i is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described in the remediation/fixes...

CVE-2025-32433

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution RCE. By exploiting a flaw in SSH protocol message handling, a malicious actor...

Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035

Stage File Proxy is a general solution for getting production files on a development server on demand. The module doesn't sufficiently validate the existence of remote files prior to attempting to download and create them. An attacker could send many requests and exhaust disk resources. This...

CVE-2025-30692

...

Security Bulletin: IBM Engineering Requirements Management DOORS Next is vulnerable to Reflected File Download (CVE-2024-43169)

Summary IBM Engineering Requirements Management DOORS Next is vulnerable to Reflected File Download CVE-2024-43169. Vulnerability Details CVEID:CVE-2024-43169 DESCRIPTION: IBM Engineering Requirements Management DOORS Next could allow a user to download a malicious file without verifying the...