Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.40 CVE-2025-31650: invalid priority field values should be ignored bsc1242008 CVE-2025-31651: Better handling of URLs with literal ';' and '?' bsc1242009 Full changelog:...

PT-2025-23263 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The issue allows an attacker to upload an HTML file containing malicious JavaScript code to the server, resulting in a Cross-Site Scripting XSS vulnerability. This occurs when the .htaccess fil...

Spring gRPC Promoted!

It's a few months since we had a blog about Spring gRPC that wasn't just a release announcement. This one marks the first release since the project was promoted from experimental to a full member of the Spring Portfolio. This doesn't change the way you consume the project, but it has some...

PT-2025-23250 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.178 Description: The issue is related to Cross-Site Scripting XSS attacks due to incorrect input validation and sanitization of user-input data in the conversation POST data body. Recommendations: For versions...

PT-2025-23258 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The issue is related to Cross-Site Scripting XSS attacks due to insufficient data validation and sanitization during data reception. This allows attackers to execute malicious scripts on the...

PT-2025-23179 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The system does not provide a check on which clients an authorized user can view and edit. As a result, an authorized user without access to existing mailboxes or conversations can view and edi...

PT-2025-21131 · Fortinet · Fortiproxy +2

Name of the Vulnerable Software and Affected Versions: Fortinet FortiProxy versions 7.6.0 through 7.6.1 FortiSwitchManager version 7.2.5 FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 Description: A missing authentication for critical functions in Fortinet products may allow an attacker...

PT-2025-21004 · Microsoft · Visual Studio

Name of the Vulnerable Software and Affected Versions: Visual Studio versions prior to 17.13.3 Description: The issue is related to improper neutralization of special elements used in a command, allowing an unauthorized attacker to execute code locally. This is a command injection vulnerability i...

PT-2025-20917

Name of the Vulnerable Software and Affected Versions: OXID eShop versions prior to 7 Description: An issue in OXID eShop allows CMS pages, when used in combination with Smarty, to potentially display user information if a CMS page contains a Smarty syntax error. Recommendations: For versions pri...

PT-2025-20906 · Phoenix · Phoenix Securecore Technology 4

Name of the Vulnerable Software and Affected Versions: Phoenix SecureCore Technology 4 versions 4.0.1.0 through 4.0.1.1017 Phoenix SecureCore Technology 4 versions 4.1.0.1 through 4.1.0.572 Phoenix SecureCore Technology 4 versions 4.2.0.1 through 4.2.0.337 Phoenix SecureCore Technology 4 versions...

PT-2025-20854 · Siemens · User Management +4

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo versions 4.1 through 5.0 SINEC NMS affected versions not specified SINEMA Remote Connect affected versions not specified Totally Integrated Automation Portal TIA Portal versions 17 through 20 User Management Component UMC...

PT-2025-20801 · Kanboard · Kanboard

Name of the Vulnerable Software and Affected Versions: Kanboard versions 1.2.26 through 1.2.44 Description: The issue is a Stored Cross-Site Scripting XSS vulnerability in the name parameter of the "http://localhost/?controller=ProjectCreationController&action=create" form. This allows attackers ...

PT-2025-20690 · Espocrm · Espocrm

Name of the Vulnerable Software and Affected Versions: EspoCRM versions prior to 9.0.8 Description: The issue allows for HTML Injection in Knowledge Base KB articles, leading to complete page defacement that can imitate the login page. Authenticated users with the read knowledge article privilege...

PT-2025-20829 · Gnu · Gnu Screen

Name of the Vulnerable Software and Affected Versions: Screen versions 5.0.0 Description: The issue is related to the logfile reopen function in the GNU screen terminal multiplexer. When Screen runs with setuid-root privileges, it does not drop privileges while operating on a user-supplied path...

PT-2025-20700 · Wpeverest · Everest Forms

Name of the Vulnerable Software and Affected Versions: WPEVEREST Everest Forms versions prior to 3.0.9 Description: The issue allows an attacker to execute arbitrary code via a file upload, exploiting a Cross Site Scripting vulnerability. Recommendations: For versions prior to 3.0.9, update to...

PT-2025-20734 · Apple · Macos Sequoia +1

Name of the Vulnerable Software and Affected Versions: macOS Sequoia versions prior to 15.5 Description: A file quarantine bypass issue was addressed with additional checks, which may have allowed an app to break out of its sandbox. Recommendations: For versions prior to 15.5, update to macOS...

PT-2025-20799 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.5 Description: The issue was addressed with improved input sanitization. An app may be able to gain elevated privileges. Recommendations: For versions prior to 15.5, update to macOS Sequoia 15.5 to resolve the issue...

PT-2025-20704 · Sudo-Rs · Sudo-Rs

Name of the Vulnerable Software and Affected Versions: sudo-rs versions prior to 0.2.6 Description: The issue allows users with limited sudo privileges to enumerate the sudoers file, revealing sensitive information about other users' permissions. This can be achieved using the -U flag. Attackers...

PT-2025-23033 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 137.0.7151.55 Description: The issue is related to an inappropriate implementation in BFCache, allowing a remote attacker to potentially obtain user information via a crafted HTML page. Recommendations: For...

PT-2025-20619 · WordPress · The Wordpress Review Plugin

Name of the Vulnerable Software and Affected Versions: The WordPress Review Plugin: The Ultimate Solution for Building a Review Website versions up to, and including, 5.3.5 Description: The WordPress Review Plugin is vulnerable to Local File Inclusion, allowing authenticated attackers with...