CVE-2025-24022

CVE-2025-24022 affects the iTop web-based IT Service Management tool. The vulnerability allows server-side code execution via the portal frontend in affected versions prior to 2.7.12, 3.1.3, and 3.2.1. It is fixed in those same release lines (2.7.12, 3.1.3, 3.2.1). These details come from multipl...

PT-2025-21168 · Itop · Itop

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 2.7.12 iTop versions prior to 3.1.3 iTop versions prior to 3.2.1 Description: The issue affects iTop, a web-based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having...

PT-2025-21171 · Itop · Itop

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 2.7.12 iTop versions 3.0.0 through 3.1.3 iTop versions 3.2.0 through 3.2.1 Description: iTop is a web-based IT Service Management tool. Server code execution is possible through the frontend of iTop's portal. This issue...

Alibaba Cloud Linux 3 : 0077: java-17-openjdk (ALINUX3-SA-2024:0077)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0077 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-21011: Vulnerability in the Oracl...

CVE-2025-30207

Kirby (open-source CMS) is affected by a path traversal vulnerability in its router when using PHP’s built-in server. Versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 allow an attacker to navigate files outside the Kirby installation via the router delegating all existing files to PHP, enabling exi...

CVE-2025-46821

Envoy is a cloud-native edge/middle/service proxy. Prior to versions 1.34.1, 1.33.3, 1.32.6, and 1.31.8, Envoy's URI template matcher incorrectly excludes the character from a set of valid characters in the URI path. As a result URI path containing the character will not match a URI template...

PT-2025-20368 · Rti · Rti Connext Professional

Name of the Vulnerable Software and Affected Versions: RTI Connext Professional versions 6.0.0 through 6.1.2.23 RTI Connext Professional versions 7.0.0 through 7.3.0.7 RTI Connext Professional versions 7.4.0 through 7.5.0 Description: The issue is an Out-of-bounds Read, Out-of-bounds Write...

CVE-2025-46827

Graylog has a vulnerability (CVE-2025-46827) where an HTML form in an Event Definition Remediation Step can leak user session cookies if an attacker has create-event-definition rights and the victim can view alerts, with an active input to receive form data. Affected versions are before 6.0.14, 6...

PT-2025-20116 · Unknown · Rustaurius Ultimate Wp Mail

Name of the Vulnerable Software and Affected Versions: Rustaurius Ultimate WP Mail versions 1.3.4 and below Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows unauthorized access and enables...

CVE-2025-32376 Discourse DM limits aren’t always properly enforced

Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable...

CVE-2025-32432

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity...

CVE-2025-32432

CVE-2025-32432 affects Craft CMS across 3.x (3.0.0-RC1–3.9.14), 4.x (4.0.0-RC1–4.14.14), and 5.x (5.0.0-RC1–5.6.16). The vulnerability is a remote code execution via insecure deserialization in the asset transform path (notably /actions/assets/generate-transform) that can be triggered by crafted ...

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20250422T181640 2025-04-22T18:16:40Z jscPED-11136 GO-2025-3603 GO-2025-3604 GO-2025-3607 GO-2025-3608 GO-2025-3609 GO-2025-3610 GO-2025-3611 GO-2025-3612 GO-2025-3615 GO-2025-3618 GO-2025-3619 GO-2025-3620...

PT-2025-17891 · Quantum · Quantum Stornext Web Gui Api +3

Name of the Vulnerable Software and Affected Versions: StorNext RYO versions prior to 7.2.4 StorNext Xcellis Workflow Director versions prior to 7.2.4 ActiveScale Cold Storage versions prior to 7.2.4 Quantum StorNext Web GUI API versions prior to 7.2.4 Description: The issue allows potential...

Mattermost Server 9.11.x < 9.11.10 / 10.4.x < 10.4.4 / 10.5.x < 10.5.2 / 10.6.0 (MMSA-2025-00436)

The version of Mattermost Server installed on the remote host is prior to 9.11.10, 10.4.4, or 10.5.2 / 10.6.0. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00436 advisory. - Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to properly...

PT-2025-17662 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 17.7 through 17.9.6 GitLab EE versions 17.10 through 17.10.4 GitLab EE versions 17.11 through 17.11.0 Description: An issue has been discovered in access controls that could allow users to view certain restricted project...

PT-2025-17630 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O kernel versions 5.2 through 05.29.49 Insyde InsydeH2O kernel versions 5.3 through 05.38.49 Insyde InsydeH2O kernel versions 5.4 through 05.46.49 Insyde InsydeH2O kernel versions 5.5 through 05.54.49 Insyde InsydeH2O kernel...

SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:1359-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:1359-1 advisory. - Update to version 0.0.20250416T165455 2025-04-16T16:54:55Z. jscPED-11136: GO-2025-3595 - Update to version 0.0.20250410T162706...

PT-2025-17547 · Centreon · Centreon Bam

Name of the Vulnerable Software and Affected Versions: Centreon BAM versions 23.04 through 23.04.9 Centreon BAM versions 23.10 through 23.10.9 Centreon BAM versions 24.04 through 24.04.4 Centreon BAM versions 24.10 through 24.10.0 Description: The issue is related to an SQL Injection vulnerabilit...

openSUSE 15 Security Update : coredns (openSUSE-SU-2025:0131-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2025:0131-1 advisory. - Update to version 1.12.1: core: Increase CNAME lookup limit from 7 to 10 7153 plugin/kubernetes: Fix handling of pods having DeletionTimestamp set...