CVE-2025-4648 A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.

The content of a SVG file, received as input in Centreon web, was not properly checked. Allows Reflected XSS. A user with elevated privileges can inject JS script by altering the content of a SVG media, during the submit request. This issue affects web: from 24.10.0 before 24.10.5, from 24.04.0...

Adobe Bridge 14.x < 14.1.7 / 15.x < 15.0.4 Multiple Vulnerabilities (APSB25-44)

The version of Adobe Bridge installed on the remote Windows host is prior to 14.1.7 or 15.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb25-44 advisory. - Bridge versions 15.0.3, 14.1.6 and earlier are affected by an Integer Overflow or Wraparound vulnerabili...

Amazon Linux AMI : kernel (ALAS-2025-1977)

The version of kernel installed on the remote host is prior to 4.14.355-196.643. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2025-1977 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: do not clean up repair bio if submit fai...

Adobe Animate 23.x < 23.0.12 / 24.x < 24.0.9 Multiple Vulnerabilities (APSB25-42)

The version of Adobe Animate installed on the remote Windows host is prior to 23.0.12 or 24.0.9. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb25-42 advisory. - Animate versions 24.0.8, 23.0.11 and earlier are affected by an Access of Uninitialized Pointer...

firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended...

Tenable Identity Exposure < 3.77.11 Multiple Vulnerabilities (TNS-2025-07)

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.11. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2025-07, including the following: - Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may...

CVE-2025-22872 affecting package kube-vip-cloud-provider for versions less than 0.0.10-4

CVE-2025-22872 affecting package kube-vip-cloud-provider for versions less than 0.0.10-4. A patched version of the package is available...

CVE-2025-22872 affecting package sriov-network-device-plugin for versions less than 3.6.2-9

CVE-2025-22872 affecting package sriov-network-device-plugin for versions less than 3.6.2-9. A patched version of the package is available...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2025-100)

The version of kernel installed on the remote host is prior to 5.4.292-208.414. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-100 advisory. In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free of encap...

CVE-2025-46674

NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress not intended for use during flight, potentially leading to a keystream oracle...

FreeBSD : Gitlab -- Vulnerabilities (11b71871-20ba-11f0-9471-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 11b71871-20ba-11f0-9471-2cf05da270f3 advisory. Gitlab reports: Cross Site Scripting XSS in Maven Dependency Proxy through CSP directives Cros...

7-Zip Multiple Vulnerabilities (Apr 2025) - Windows

7zip is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:7-zip:7-zip"; ifdescription...

Mozilla Thunderbird < 128.9.2

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.9.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-27 advisory. - When an email contains multiple attachments with external links via the...

CVE-2025-23389

A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3...

Moodle < 3.9.23 JQuery UI Library Upgrade

According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.23 or 3.11.x prior to 3.11.16. The JQuery UI library included with Moodle has been upgraded to version 1.13.2, which includes fixes for multiples security issues. Note that the scanner has not...

CVE-2025-30647

CVE-2025-30647 affects Junos OS on Juniper MX Series. A memory leak in the packet forwarding engine (PFE) during subscriber management (login/logout) can progressively exhaust memory, enabling an unauthenticated adjacent attacker to cause a Denial-of-Service. Affected versions are: before 21.2R3-...

WordPress Motors plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by mikemyers in WordPress Plugin Motors versions = 1.4.64...

BIT-JOOMLA-2022-27912 [20221001] - Core - Debug Mode leaks full request payloads including passwords

An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests...

BIT-JOOMLA-2022-23800 [20220308] - Core - Inadequate content filtering within the filter code

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components...

BIT-DOLIBARR-2024-5314 Multiple vulnerabilities in DOLIBARR's ERP CMS

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in...