Linux Distros Unpatched Vulnerability : CVE-2017-9465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The yrarenawritedata function in YARA 3.6.1 allows remote attackers to cause a denial of service buffer over-read and application crash or obtain sensitive...

WordPress Real Spaces Theme <= 3.6 is vulnerable to Privilege Escalation

Software Real Spaces Type Theme Vulnerable versions = 3.6 Fixed in 3.6.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-6758 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 53452ea06b41 Credits Alyudin Nafiie...

Security update for apache-commons-lang3

This update for apache-commons-lang3 fixes the following issues: Update to version 3.18.0 CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. bsc1246397 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2025:02818-1 Security update for apache-commons-lang3

This update for apache-commons-lang3 fixes the following issues: - Update to version 3.18.0 - CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. bsc1246397...

Malicious code in @zalastax/nolb-_v3 (npm)

The package @zalastax/nolb-v3 was found to contain malicious code...

CVE-2025-55198

A flaw was found in helm.sh/helm/v3. Improper validation of type errors during parsing of Chart.yaml and index.yaml files can trigger a panic. A remote attacker, requiring user interaction, can trigger this panic via a malformed chart file. This can lead to an application level denial of service...

AZL-66318 CVE-2025-55199 affecting package helm 3.14.2-10

Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory OOM termination. This issue has been resolved in Helm 3.18.5. A workaround involves...

PT-2025-33380 · Unknown · Aa Web Servant 12 Step Meeting List

Name of the Vulnerable Software and Affected Versions: AA Web Servant 12 Step Meeting List versions through 3.18.3 Description: AA Web Servant 12 Step Meeting List is susceptible to a cross-site scripting XSS issue due to improper neutralization of input during web page generation. This allows fo...

INSTAR 2K+和INSTAR 4K 安全漏洞

INSTAR 2K+ and INSTAR 4K are both webcams from INSTAR, Germany. A security vulnerability exists in INSTAR 2K+ and INSTAR 4K version 3.11.1 Build 1124, which stems from improper physical access control of the UART Interface component...

CVE-2025-40746

A vulnerability has been identified in SIMATIC RTLS Locating Manager All versions V3.2. Affected products do not properly validate input for a backup script. This could allow an authenticated remote attacker with high privileges in the application to execute arbitrary code with 'NT...

Siemens SIMATIC RTLS Locating Manager 安全漏洞

Siemens SIMATIC RTLS Locating Manager is an RTLS locating manager from Siemens, Germany. A security vulnerability exists in Siemens SIMATIC RTLS Locating Manager versions prior to V3.3, which stems from improperly protected credentials and could result in elevated privileges...

Siemens SINEC Traffic Analyzer 安全漏洞

Siemens SINEC Traffic Analyzer is a network traffic analysis tool from Siemens Germany. A security vulnerability exists in Siemens SINEC Traffic Analyzer versions prior to V3.0, which stems from insufficient docker container isolation controls and could lead to elevated privileges...

Siemens SINEC Traffic Analyzer 信息泄露漏洞

Siemens SINEC Traffic Analyzer is a network traffic analysis tool from Siemens Germany. An information disclosure vulnerability exists in Siemens SINEC Traffic Analyzer versions prior to V3.0, which originates from an internal service port exposure that could lead to unauthorized access...

PT-2025-32664 · Siemens · Sinec Traffic Analyzer

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to 3.0 Description: The application uses a Content Security Policy that allows unsafe script execution methods. This could allow an attacker to execute unauthorized scripts, potentially leading to...

DEBIAN-CVE-2025-40920

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. Data::UUID does not use a strong cryptographic source for generating UUIDs. Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable...

CVE-2025-40920

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. Data::UUID does not use a strong cryptographic source for generating UUIDs. Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable...

CVE-2025-40920 Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. Data::UUID does not use a strong cryptographic source for generating UUIDs. Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable...

CVE-2025-40920

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. Data::UUID does not use a strong cryptographic source for generating UUIDs. Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable...

CVE-2025-40920 Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. Data::UUID does not use a strong cryptographic source for generating UUIDs. Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable...

CVE-2025-8840

Summary (CVE-2025-8840, jshERP): Up to version 3.5, jshERP’s Endpoint component exposes an authorization flaw in the file /jshERP-boot/user/deleteBatch where manipulation of the argument ids enables a remote attack. Public exploit disclosure is noted. Several sources corroborate an improper autho...