OPENSUSE-SU-2025:15549-1 liblog4cxx-devel-1.5.0-1.1 on GA media

These are all security issues fixed in the liblog4cxx-devel-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed...

Fedora: Security Advisory (FEDORA-2025-a8501d6717)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-27466 Mutiple vulnerabilities in the Viridian interface

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference...

Improper Access Control

Directus is vulnerable to an improper access control vulnerability. The vulnerability is due to a flaw in the file update mechanism, which allows an attacker to modify existing files or upload arbitrary files without authentication, bypassing metadata tracking and evading visibility in the Direct...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.80 security and extras update

Red Hat OpenShift Container Platform release 4.12.80 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a security impact of...

CVE-2025-9634

The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the pubsave action handler. This makes it possible for unauthenticated attackers to disable or enable plug...

CVE-2025-9634

CVE-2025-9634 concerns the WordPress plugin “Plugin updates blocker” (versions up to and including 0.2). The flaw is a CSRF vulnerability caused by missing or incorrect nonce validation on the pub_save action, enabling unauthenticated attackers to toggle plugin updates (disable/enable) by luring ...

CVE-2025-9634 Plugin updates blocker <= 0.2 - Cross-Site Request Forgery

The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the pubsave action handler. This makes it possible for unauthenticated attackers to disable or enable plug...

CVE-2025-9634 Plugin updates blocker <= 0.2 - Cross-Site Request Forgery

The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the pubsave action handler. This makes it possible for unauthenticated attackers to disable or enable plug...

WordPress Plugin updates blocker plugin <= 0.2 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Nabil Irawan in WordPress Plugin Plugin updates blocker versions = 0.2...

WordPress plugin Plugin updates blocker 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

SUSE SLES15 Security Update : kernel (Live Patch 47 for SLE 15 SP3) (SUSE-SU-2025:03130-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03130-1 advisory. This update for the Linux Kernel 5.3.18-15030059170 fixes several issues. The following security issues were fixed: - CVE-2025-21999: proc: fi...

PT-2025-37152

The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the pub save action handler. This makes it possible for unauthenticated attackers to disable or enable...

Important Photon OS Security Update - PHSA-2025-4.0-0868

Updates of 'cups' packages of Photon OS have been released...

Security Updates for Microsoft Office Products C2R (September 2025)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple remote code execution vulnerabilities that attackers can exploit to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for these issues but has instea...

Security Updates for Microsoft Word Products C2R (September 2025)

The Microsoft Word Products are missing security updates. It is, therefore, affected by an information disclosure vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc...

Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

A reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML...

Cisco IOS XR ARP Broadcast Storm Denial of Service Vulnerability

A vulnerability in the Address Resolution Protocol ARP implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a broadcast storm, leading to a denial of service DoS condition on an affected device. This vulnerability is due to how Cisco IOS XR Software...

Vulnerability fixed in Adobe Commerce and Magento

Adobe has fixed a vulnerability in Adobe Commerce and Magento. The vulnerability is in the way input is validated in Adobe Commerce and Magento. This vulnerability allows attackers to perform session takeover attacks without any user interaction, which can compromise the confidentiality and...

CVE-2022-50238

The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. Some entries present on the online list have been excluded from the on-endpoint blocklist longer than the expected periodic monthly Windows updates. It is...