CVE-2025-65564

A denial-of-service vulnerability exists in the omec-upf upf-epc-pfcpiface in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Association Setup Request that is missing the mandatory Recovery Time Stamp Information Element, the association setup handler dereferences a nil pointer...

EulerOS Virtualization 2.13.0 : grub2 (EulerOS-SA-2025-2577)

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : GNU GRUB aka GRUB2 through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS...

Fedora 42 : golang-github-facebook-time (2025-b8d9bd75d2)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-b8d9bd75d2 advisory. Update logrus for https://access.redhat.com/security/cve/cve-2025-65637 Tenable has extracted the preceding description block directly from the Fedora securi...

Fedora: Security Advisory (FEDORA-2025-b8d9bd75d2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 43 : golang-github-facebook-time (2025-6e8c819299)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-6e8c819299 advisory. Update logrus for https://access.redhat.com/security/cve/cve-2025-65637 Tenable has extracted the preceding description block directly from the Fedora securi...

PT-2025-52219

A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data. An unauthenticated attacker can send specially crafted network packets at two different times to inject HTML tags into asset attributes across t...

CVE-2025-65564

A denial-of-service vulnerability exists in the omec-upf upf-epc-pfcpiface in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Association Setup Request that is missing the mandatory Recovery Time Stamp Information Element, the association setup handler dereferences a nil pointer...

PT-2025-52288

Name of the Vulnerable Software and Affected Versions omec-upf versions 2.1.3-dev Description A denial-of-service issue exists in omec-upf. Specifically, when the UPF receives a PFCP Association Setup Request lacking the mandatory Recovery Time Stamp Information Element, the association setup...

Fedora: Security Advisory (FEDORA-2025-6e8c819299)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

(0Day) NSF Unidata NetCDF-C Time Unit Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing o...

PT-2025-52389

Name of the Vulnerable Software and Affected Versions NSF Unidata NetCDF-C affected versions not specified Description A flaw exists in the parsing of time units within NSF Unidata NetCDF-C, leading to a stack-based buffer overflow. This allows a remote attacker to execute arbitrary code on...

HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0

Summary A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data. Impact An unauthenticated attacker can send specially crafted network packets at two different times to inject HTML tags into asset...

CVE-2025-67876

creationtimestamp| type| source ---|---|--- 2025-12-17 23:30:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ma7sxhotz62c...

CVE-2025-68400

ChurchCRM prior to v6.5.3 is affected by a SQL Injection in the legacy endpoint /Reports/ConfirmReportEmail.php. The issue arises from an unvalidated familyId parameter in a historically removed UI feature that remains reachable directly (dead but reachable code). Any authenticated user, even wit...

CVE-2025-68400 ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php

ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint /Reports/ConfirmReportEmail.php in ChurchCRM prior to version 6.5.3. Although the feature was removed from the UI, the file remains deployed and reachable directly via URL. This is a...

CVE-2025-68400 ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php

ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint /Reports/ConfirmReportEmail.php in ChurchCRM prior to version 6.5.3. Although the feature was removed from the UI, the file remains deployed and reachable directly via URL. This is a...

CVE-2025-34436

creationtimestamp| type| source ---|---|--- 2025-12-17 20:30:06+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3ma7iujtreqv2 2025-12-17 23:09:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ma7rr6wqpx2q...

CVE-2025-66396

ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the src/UserEditor.php file. When an administrator saves a user's configuration settings, the keys of the type POST parameter array are not properly sanitized or type-casted befor...

CVE-2025-67074

creationtimestamp| type| source ---|---|--- 2025-12-17 19:48:45+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115736636604385157 2025-12-17 21:15:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115736976510649976...

CVE-2025-66396 ChurchCRM has SQL Injection in User Editor via `type` Parameter Key

ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the src/UserEditor.php file. When an administrator saves a user's configuration settings, the keys of the type POST parameter array are not properly sanitized or type-casted befor...