CVE-2025-47935

CVE-2025-47935 (Multer) : Multer (Node.js multipart/form-data middleware) versions before 2.0.0 are affected by a resource exhaustion/memory‑leak due to improper stream handling. When the HTTP request stream errors, the internal busboy stream is not closed, causing streams to accumulate and consu...

Security Bulletin:IBM Event Streams is vulnerable to Remote Code Execution (RCE) attack due to the jsonpath-plus ( CVE-2025-1302).

Summary IBM Event Streams is vulnerable to Remote Code Execution RCE due to the jsonpath-plus package, which is typically used for querying and extracting specific data from complex JSON documents, helping in parsing message payloads, filtering data within topics, and extracting specific fields f...

Security Bulletin:IBM Event Streams is vulnerable to a Deniel of service (DoS) attack due to the path-to-regexp (CVE-2024-45296).

Summary IBM Event Streams is vulnerable to a Denial of Service DoS attack due to the path-to-regexp component, a JavaScript library that converts path strings into regular expressions to match and extract parameters from URLs or other structured data based on defined path patterns. Vulnerability...

Ubiquiti UniFi Protect Cameras 安全漏洞

The Ubiquiti UniFi Protect Application is an enterprise-grade security monitoring platform that supports both home and business users. A security vulnerability exists in Ubiquiti UniFi Protect Application, which stems from a misconfigured access token mechanism that can be exploited by an attacke...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 11.7.0. Vulnerability Details CVEID:CVE-2024-52798 DESCRIPTION: path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cau...

Security Bulletin: Improper Privilege Management vulnerability in IBM Event Streams

Summary IBM Event Streams is vulnerable to Improper Privilege Management vulnerability in Apache Kafka Clients to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments like in a SaaS. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION...

php: Streams HTTP wrapper does not fail for headers with invalid name and no colon

A flaw was found in PHP. This vulnerability allows applications to accept invalid headers via malformed HTTP headers missing a colon :, which may confuse applications into processing them as valid headers...

php: libxml streams use wrong content-type header when requesting a redirected resource

A flaw was found in PHP's DOM and SimpleXML extensions. This vulnerability allows incorrect parsing of a redirected HTTP resource via improper content-type header handling...

php: Streams HTTP wrapper does not fail for headers with invalid name and no colon

A flaw was found in PHP. This vulnerability allows applications to accept invalid headers via malformed HTTP headers missing a colon :, which may confuse applications into processing them as valid headers...

php: libxml streams use wrong content-type header when requesting a redirected resource

A flaw was found in PHP's DOM and SimpleXML extensions. This vulnerability allows incorrect parsing of a redirected HTTP resource via improper content-type header handling...

php: Streams HTTP wrapper does not fail for headers with invalid name and no colon

A flaw was found in PHP. This vulnerability allows applications to accept invalid headers via malformed HTTP headers missing a colon :, which may confuse applications into processing them as valid headers...

php: libxml streams use wrong content-type header when requesting a redirected resource

A flaw was found in PHP's DOM and SimpleXML extensions. This vulnerability allows incorrect parsing of a redirected HTTP resource via improper content-type header handling...

UBUNTU-CVE-2025-37870

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: prevent hang on link training fail Why When link training fails, the phy clock will be disabled. However, in enablestreams, it is assumed that link training succeeded and the mux selects the phy clock, causing a...

The vulnerability in the Splunk Web platform for operational analysis of Splunk Enterprise’s web interface allows attackers to bypass security restrictions, increase their privileges, and execute arbitrary commands.

The vulnerability in the Splunk Web platform for operational analysis in Splunk Enterprise relates to insufficient protection of sensitive data when processing the /services/streams/search endpoint with the q parameter. Exploiting this vulnerability allows an attacker to bypass security...

CLSA-2025-1745530523 php: Fix of CVE-2025-1219

CVE-2025-1219: fix libxml streams wrong content-type on redirect...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 11.6.1. Vulnerability Details CVEID:CVE-2024-47764 DESCRIPTION: jshttp cookie could allow a remote attacker to bypass security restrictions, caused by improper input validation by the cookie name, path, and domain. By...

Palo Alto Networks PAN-OS 10.1.x < 10.1.14-h13 / 10.2.x < 10.2.15 / 11.1.x < 11.1.8 / 11.2.x < 11.2.6 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14-h13 or 10.2.x prior to 10.2.15 or 11.1.x prior to 11.1.8 or 11.2.x prior to 11.2.6. It is, therefore, affected by a vulnerability. A vulnerability in the Palo Alto Networks PAN-OS software enables...

event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in EDA

A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams...

event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in EDA

A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams...

Security Bulletin: Multiple Java Vulnerabilities in IBM Event Streams

Summary Multiple Java SE vulnerabilities were addressed in IBM Event Streams version 11.5.1. Vulnerability Details CVEID:CVE-2024-21235 DESCRIPTION: Vulnerability in Java SE component: Hotspot. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...