630 matches found
EUVD-2023-46371
Malicious code in bioql PyPI...
EUVD-2024-43186
Malicious code in bioql PyPI...
Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache XML Security for Java.
Summary Multiple vulnerabilities in Apache XML Security for Java that is used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2024-20945 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a local authenticated attacker...
Security Bulletin: SSL Certificate Hostname Verification Bypass in Apache Commons HttpClient 3.x Allowing MITM Attacks affects watsonx.data
Summary Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...
Linux Distros Unpatched Vulnerability : CVE-2024-1580
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. W...
Linux Distros Unpatched Vulnerability : CVE-2023-39513
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability...
PT-2025-34506 Ā· Liferay Ā· Liferay PortalĀ +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.3.131 and earlier, 7.4.0 through 7.4 GA update 92 Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP...
PT-2025-33681 Ā· Liferay Ā· Liferay PortalĀ +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2025.Q1.0 through 2025.Q1.8 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP versions 2024.Q2.0 through...
PT-2025-33424 Ā· Mtons Ā· Mtons Mblog
Name of the Vulnerable Software and Affected Versions: mtons mblog versions up to 3.5.0 Description: A cross-site request forgery issue exists in mtons mblog. The issue affects some unknown functionality and can be exploited remotely. The exploit has been publicly disclosed. Recommendations: Upda...
PT-2025-33155 Ā· WordPress Ā· Wp Pipes
Name of the Vulnerable Software and Affected Versions: WP Pipes versions through 1.4.3 Description: WP Pipes is susceptible to a PHP Local File Inclusion issue due to improper control of filename for include/require statements. This allows for the inclusion of local files. Recommendations: Update...
CVE-2025-8804
Open5GS up to version 2.7.5 is affected. The vulnerability lies in the ngap_build_downlink_nas_transport function in the AMF component, which can lead to a reachable assertion. The issue can be exploited remotely, and public disclosure of exploits is noted. The approved fix is to upgrade to versi...
PT-2025-31494 Ā· Apache JspwikiĀ +1 Ā· Image PluginĀ +1
Name of the Vulnerable Software and Affected Versions: Apache JSPWiki versions prior to 2.12.3 Description: A carefully crafted request using the Image plugin could trigger a cross-site scripting XSS issue on Apache JSPWiki. This could allow an attacker to execute JavaScript in the victim's brows...
Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by a security bypass vulnerability
Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by a security bypass vulnerability CVE-2024-56339 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...
Google Chrome < 138.0.7204.168 Multiple Vulnerabilities
The version of Google Chrome installed on the remote macOS host is prior to 138.0.7204.168. It is, therefore, affected by multiple vulnerabilities as referenced in the 202507stable-channel-update-for-desktop22 advisory. - Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a...
CVE-2025-54070 OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the lastIndexOfbytes,byte,uint256 function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1 the provided buffer length...
CVE-2025-53638 Solady lacks extcodesize validation on implementation in ERC4337Factory
Solady is software that provides Solidity snippets with APIs. Starting in version 0.0.125 and prior to version 0.1.24, when an account is deployed via a proxy, using regular Solidity to call its initialization function may result in a silent failure, if the initialization function does not return...
CVE-2025-53621
DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity XXE injection possibilities impact all versions of DSpace prior to 7.6.4, 8.2, and 9.1. External entities are not disabled when parsing XML files during impo...
CVE-2025-53621 DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources
DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity XXE injection possibilities impact all versions of DSpace prior to 7.6.4, 8.2, and 9.1. External entities are not disabled when parsing XML files during impo...
Security Bulletin: Security Vulnerabilities in Java affect IBM Voice Gateway
Summary Security Vulnerabilities in Java affect IBM Voice Gateway Vulnerability Details CVEID:CVE-2025-21587 DESCRIPTION: An unspecified vulnerability in Java SE related to the Server: DDL component could allow a remote attacker to cause high confidentiality and high integrity impact. CWE:CWE-284...
BIT-TOMCAT-2025-24813 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.2, from 10.1.0 through 10.1.34,...