PT-2025-2951

Name of the Vulnerable Software and Affected Versions Git LFS versions prior to 3.6.1 Description Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checki...

SUSE: Security Advisory (SUSE-SU-2025:0071-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4012-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4012-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort January 11, 2025 https://wiki.debian.org/LTS -...

Oracle Linux 8 : firefox (ELSA-2025-0144)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-0144 advisory. 128.6.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 128.6.0 - Add debranding patches Mustafa Gezen - Add OpenELA default...

SUSE SLES15 / openSUSE 15 Security Update : apptainer (SUSE-SU-2025:0066-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0066-1 advisory. - Update to version 1.3.6 - CVE-2024-28180: Fixed an improper handling of highly compressed data in go-jose. bsc1235211 Tenable has...

PT-2025-4386 · Atheros · Atheos

Name of the Vulnerable Software and Affected Versions: Atheos versions prior to v600 Description: Atheos is a self-hosted browser-based cloud IDE. The issue is related to the lack of proper validation of the $path and $target parameters across multiple components, allowing an attacker to read,...

PT-2025-2413 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: Microweber versions prior to 2.0.9 Description: The issue allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint "/admin/module/view?type=admin backup", exploiting a Stored Cross Site Scripting X...

CVE-2025-22149 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

JWK Set JSON Web Key Set is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use...

Medium: python-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This...

PT-2025-3679 · WordPress · The Greenshift

Name of the Vulnerable Software and Affected Versions: The Greenshift – animation and page builder blocks plugin for WordPress versions prior to 9.0.1 Description: The issue is related to Authenticated Server-Side Request Forgery and Stored Cross Site Scripting due to a missing capability check i...

CVE-2025-22141 WeGIA SQL Injection (Blind Time-Based) endpoint 'verificar_recursos_cargo.php' parameter 'cargo'

WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /dao/verificarrecursoscargo.php endpoint, specifically in the cargo parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity...

PT-2025-4376 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the "/html/funcionario/dependente listar um.php" endpoint, specifically in the id dependente...

PT-2025-1901

Name of the Vulnerable Software and Affected Versions Property Hive WordPress plugin versions prior to 2.1.1 Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be...

Google Chrome Security Update (stable-channel-update-for-desktop-2025-01) - Linux

Google Chrome is prone to a type confusion vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gtk3 (SUSE-SU-2025:0031-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0031-1 advisory. - CVE-2024-6655: Fixed library injection from current working directory bsc1228120. Other fixes: - Update...

CVE-2024-52813 matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applicatio...

OPENSUSE-SU-2025:0003-1 Security update for etcd

This update for etcd fixes the following issues: Update to version 3.5.12: Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795 test: fix TestHashKVWhenCompacting: ensure all goroutine finished print error log when creating peer listener failed mvcc: Printing etcd backend database related...

PT-2025-1671 · Progress · Sitefinity

Name of the Vulnerable Software and Affected Versions: Progress Sitefinity versions 4.0 through 14.4.8142 Progress Sitefinity versions 15.0.8200 through 15.0.8229 Progress Sitefinity versions 15.1.8300 through 15.1.8327 Progress Sitefinity versions 15.2.8400 through 15.2.8421 Description: The iss...

PT-2025-4554 · Unknown · Faaiq Pretty Url

Name of the Vulnerable Software and Affected Versions: Faaiq Pretty Url versions 1.5.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. Recommendations: For versions 1.5.4 and earlier, update to a version that fixes this...

PT-2025-3704 · WordPress · Wordpress Auction Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Auction Plugin versions 3.7 and earlier Description: The issue allows editors and above to perform SQL injection attacks due to the plugin not sanitizing and escaping a parameter before using it in a SQL statement. Recommendations:...