Namada-apps allows Post-Genesis Validator Bypass

Impact Ledger crash. A user is able to initialize a post-genesis validator with a negative commission rate using the --force flag. If this validator gets into the consensus set, then when computing PoS inflation inside fn updaterewardsproductsandmintinflation, an instance of mulfloor will cause t...

PT-2025-7486 · WordPress · Lenix Elementor Leads

Name of the Vulnerable Software and Affected Versions: Lenix Elementor Leads addon plugin for WordPress versions up to, and including, 1.8.2 Description: The Lenix Elementor Leads addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a URL form field due to insufficient inpu...

WordPress Yoast SEO Plugin < 2.1 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:yoast:yoastseo"; if description...

WordPress CMS Tree Page View Plugin < 0.8.9 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cmstreepageviewproject:cmstreepageview"; ifdescription...

PT-2025-7410 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server +1

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.0 and 9.3.0.9, including 8.3.x Description: The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is us...

CVE-2025-26617 SQL Injection endpoint 'historico_paciente.php' parameter 'id_fichamedica' in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, historicopaciente.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized...

Google Chrome < 133.0.6943.126 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 133.0.6943.126. It is, therefore, affected by multiple vulnerabilities as referenced in the 202502stable-channel-update-for-desktop18 advisory. - Use after free in Network in Google Chrome prior to 133.0.6943.126 allowe...

openSUSE Security Advisory (SUSE-SU-2025:0404-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2025:0458-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-6743

Name of the Vulnerable Software and Affected Versions DAS U-Boot versions prior to 2025.01-RC1 Description A stack consumption issue occurs in the sqfs size function in DAS U-Boot through a crafted squashfs filesystem with deep symlink nesting. This issue affects the SquashFS symlink resolution...

PT-2025-6745

Name of the Vulnerable Software and Affected Versions Das U-Boot versions prior to 2025.01-rc1 Description The issue is related to an off-by-one error in the sqfs search dir function, which leads to heap memory corruption when listing SquashFS directories. This error occurs because the path...

Debian dla-4055 : trafficserver - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4055 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4055-1 [email protected]...

CVE-2025-25304 Vega allows Cross-site Scripting via the vlSelectionTuples function

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the vlSelectionTuples function can be used to call JavaScript functions, leading to cross-site...

Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0

Impact The Keylime registrar implemented more strict type checking on version 7.12.0. As a result, when updated to version 7.12.0, the registrar will not accept the format of the data previously stored in the database by versions = 7.8.0, raising an exception. This makes the Keylime registrar...

`gh attestation verify` returns incorrect exit code during verification if no attestations are present

Summary A bug in GitHub's Artifact Attestation CLI tool, gh attestation verify, may return an incorrect zero exit status when no matching attestations are found for the specified --predicate-type or the default https://slsa.dev/provenance/v1 if not specified. This issue only arises if an artifact...

CVE-2023-37415

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxyuser option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updatin...

CVE-2024-29217

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the...

CVE-2023-30771

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database. This problem is fixed from version 0.13.4 of...

CVE-2023-26269

Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX...

Oracle Linux 9 : nodejs:20 (ELSA-2025-1443)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-1443 advisory. - Update to version 20.18.2 Fixes: CVE-2025-23083 CVE-2025-23085 CVE-2025-22150 Resolves: RHEL-76363 RHEL-76554 RHEL-76540 Tenable has extracted the...