CVE-2025-49586 XWiki allows remote code execution through preview of XClass changes in AWM editor

XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application the default for all users XWiki can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0,...

CVE-2025-49585

XWiki vulnerability CVE-2025-49585 affects multiple pre-patched releases: before 15.10.16, 16.0.0-rc-1 → 16.4.6, and 16.5.0-rc-1 → 16.10.1. An attacker with no script/programming rights can create an XClass definition (requires edit rights), and if the same document is later edited by someone wit...

Security Bulletin: A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed, (CVE-2025-23184) affects IBM PowerVM Novalink.

Summary A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system it applies to servers and clients. IBM...

MINI-VR82-HF5X-MV7M

Bulletin has no description...

Fedora 41 : mingw-icu (2025-49ae47f4ef)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-49ae47f4ef advisory. Backport fix for CVE-2025-5222. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

KLA84827 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in Media can be exploited to cause denial of service or...

Photon OS 4.0: Sqlite PHSA-2025-4.0-0790

An update of the sqlite package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0790. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 8 : nodejs:20 (ELSA-2025-8514)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8514 advisory. - Update to version 20.19.2 Fixes: CVE-2025-23166 Resolves: RHEL-91595 RHEL-89598 RHEL-92854 - Update c-ares to 1.34.5 to address CVE-2025-31498 - Update to...

Oracle Linux 9 : .NET / 9.0 (ELSA-2025-8817)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8817 advisory. 9.0.107-1.0.1 - Add support for Oracle Linux 9.0.107-1 - Update to .NET SDK 9.0.107 and Runtime 9.0.6 - Resolves: RHEL-94424 Tenable has extracted the preceding...

Photon OS 5.0: Python3 PHSA-2025-5.0-0534

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0534. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM Installation Manager and IBM Packaging Utility (CVE-2025-21587)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 11 used by IBM Installation Manager and IBM Packaging Utility. The IBM Installation Manager and IBM Packaging Utility have addressed the applicable CVE. Vulnerability Details CVEID:CVE-2025-21587 DESCRIPTION: An unspecifie...

MINI-JJ4Q-W6GM-6WRW

Bulletin has no description...

MINI-Q8H7-V5PQ-9RPM

Bulletin has no description...

Vulnerabilities fixed in Trend Micro Apex One and Apex Central

Trend Micro has fixed vulnerabilities in Apex One and Apex Central. A malicious party could exploit the vulnerabilities to grant themselves elevated privileges, execute arbitrary code or gain access to sensitive data. Trend Micro has released updates to fix the vulnerabilities. See attached...

Vulnerabilities fixed in Ivanti Workspace Control

Ivanti has fixed vulnerabilities in Ivanti Workspace Control Specifically for versions prior to 10.19.10.0. The vulnerabilities are in the hard-coded keys within Ivanti Workspace Control, specifically in versions prior to 10.19.10.0. These vulnerabilities allow local, authenticated attackers to...

Vulnerabilities fixed in Fortinet FortiOS

Fortinet has fixed vulnerabilities in FortiOS. The vulnerabilities include improper certificate validation that allows attackers to connect to FortiClient via revoked certificates, leading to unauthorized access. In addition, there are vulnerabilities in session escalation and privilege managemen...

RHSA-2025:8978 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update

Bulletin has no description...

Security Bulletin: Vulnerability in Babel runtime library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2025-27789)

Summary Babel is a compiler used to generate JavaScript code for Tivoli Netcool/OMNIbus WebGUI Event Viewer, Netcool Operations Insight NOI Event Analytics Configuration and Scope Based Grouping client components. Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a compiler for...

Huawei EulerOS: Security Advisory for elfutils (EulerOS-SA-2025-1650)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Photon OS 4.0: Linux PHSA-2025-4.0-0811

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0811. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...