CVE-2024-24761

Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, public pages are per default restricted to only administrators and staff members. From configuration, it is possible to restrict to up-to-date members or to...

CVE-2024-28871

LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessive CPU usage. Version 0.5.47 contains a patch for the issue. No known workarounds are available...

Medium: ruby3.2

Issue Overview: A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396parser.rb and rfc3986parser.rb. NOTE: this issue...

PT-2025-5726 · Progress · Loadmaster

Name of the Vulnerable Software and Affected Versions: LoadMaster versions 7.2.48.12 and earlier LoadMaster versions 7.2.49.0 through 7.2.54.12 LoadMaster versions 7.2.55.0 through 7.2.60.1 ECS versions prior to 7.2.60.1 Description: The issue is related to improper input validation of...

CVE-2024-13496

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and la...

CVE-2024-39907

1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to...

PT-2025-4174 · Smr · Smr

Name of the Vulnerable Software and Affected Versions: SMR versions prior to January 2025 Release 1 Description: A failure in the protection mechanism of the bootloader allows physical attackers to execute the fastboot command. User interaction is required to trigger this issue. Recommendations:...

PT-2025-4130 · Mozilla +9 · Thunderbird +11

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 135 Firefox ESR versions prior to 128.7 Thunderbird versions prior to 128.7 Thunderbird versions prior to 135 Description: Memory safety bugs have been detected in Firefox and Thunderbird, showing evidence of memory...

PT-2025-4738

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.23.6 Go versions prior to 1.22.12 Description The issue concerns a security fix in the crypto/elliptic module. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a sma...

PT-2025-3931 · Mozilla +8 · Thunderbird +8

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 128.7 Thunderbird versions prior to 135 Description: The issue arises when the From field of an email uses invalid group name syntax. This results in Thunderbird displaying an incorrect sender address...

PT-2025-7901 · Esri · Esri Arcgis Allsource

Name of the Vulnerable Software and Affected Versions: Esri ArcGIS AllSource versions 1.2 through 1.3 Description: There is an untrusted search path vulnerability that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the...

openSUSE: Security Advisory for buildah (SUSE-SU-2025:0319-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2025-035-01)

The version of mozilla-firefox installed on the remote host is prior to 128.7.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-035-01 advisory. New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Tenable has...

CVE-2025-24901

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, deletarpermissao.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information...

CVE-2025-23210

CVE-2025-23210 affects the PHPSpreadsheet library. Affected versions allow bypassing the XSS sanitizer when processing XML input, enabling execution of attacker-controlled JavaScript in the browser upon rendering HTML. The issue is fixed in PhpSpreadsheet versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9;...

Security update for docker

This update for docker fixes the following issues: Security fixes: CVE-2024-23651: Fixed arbitrary files write due to race condition on mounts bsc1219267 CVE-2024-23652: Fixed insufficient validation of parent directory on mount bsc1219268 CVE-2024-23653: Fixed insufficient validation on...

CVE-2025-0377

An archive extraction vulnerability was found in HashiCorp's go-slug library. When go-slug performs an extraction, the filename/extraction path is taken from the tar entry via the header.Name. It was discovered that the unpacking step improperly validated paths, potentially leading to path...

SUSE SLES15 / openSUSE 15 Security Update : google-osconfig-agent (SUSE-SU-2025:0302-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:0302-1 advisory. - Update to version 20250115.01 bsc1236406, bsc1236407 - CVE-2024-24790: Bump the golang compiler version to 1.22.4 bsc1225974...

SUSE-SU-2025:0320-1 Security update for buildah

This update for buildah fixes the following issues: - Update to version 1.35.5 - CVE-2024-11218: Fix TOCTOU error when bind and cache mounts use 'src' values. bsc1236272...

PT-2025-1998

Name of the Vulnerable Software and Affected Versions Widget4Call WordPress plugin versions 1.0.0 through 1.0.7 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...