[SECURITY] [DLA 4253-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4253-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort July 27, 2025 https://wiki.debian.org/LTS -...

CVE-2025-8219 Shanghai Lingdang Information Technology Lingdang CRM HTTP POST Request tabdetail_moduleSave_dxkp.php sql injection

A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. It has been rated as critical. This issue affects some unknown processing of the file /crm/crmapi/erp/tabdetailmoduleSavedxkp.php of the component HTTP POST Request Handler. The manipulation of the...

CVE-2025-22165

This Medium severity ACE Arbitrary Code Execution vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE Arbitrary Code Execution vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview dbgate-api is an Allows run DbGate data-manipulation scripts. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via the file parameter in the /uploads/get endpoint. An attacker can access arbitrary files on the system by supplying a...

SimpleHelp < 5.5.11 XSRF

The version of SimpleHelp running on the remote web server is prior to 5.5.11. It is, therefore, affected by a cross-site request forgery XSRF vulnerability. Note that this vulnerability can be used in conjunction with CVE-2025-36727 to fully compromise a target. Note that Nessus has not tested f...

GitLab 15.4 < 18.0.5 / 18.1 < 18.1.3 / 18.2 < 18.2.1 (CVE-2025-1299)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Missing Authorization in GitLab CVE-2025-1299 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenabl...

CVE-2025-54090

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue...

CVE-2025-54090

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue...

CVE-2025-54090 Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue...

CVE-2025-54090 Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue...

CVE-2025-54090

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue...

SUSE SLES15: postgresql17-llvmjit / postgresql17-llvmjit-devel / etc (SUSE-SU-2025:01783-2)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:01783-2 advisory. Upgrade to 17.5: - CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation...

Arbitrary File Upload

Overview marshmallow/nova-tiptap is a Laravel Nova tiptap editor field. Affected versions of this package are vulnerable to Arbitrary File Upload via the /nova-tiptap/api/file endpoint, which lacks authentication and file validation. An attacker can upload arbitrary files, including executable or...

CVE-2025-49656

Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue...

CVE-2025-50151

File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload...

CVE-2025-50151 Apache Jena: Configuration files uploaded by administrative users are not check properly

File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload...

CVE-2025-50151

CVE-2025-50151 affects Apache Jena up to version 5.4.0, where file access paths in configuration files uploaded by administrators are not validated. The issue’s root cause is the missing validation of configuration file paths, allowing potential arbitrary file access. Mitigation: upgrade to Apach...

PT-2025-30273 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 21.0 MR2 21.0.2 Description: An SQL injection vulnerability exists in the legacy transparent SMTP proxy. Successful exploitation can lead to remote code execution if a quarantining policy is active for Email...

PT-2025-30258 · Apache +1 · Apache Jena +1

Name of the Vulnerable Software and Affected Versions: Apache Jena versions up to 5.4.0 Description: The application does not validate file access paths within configuration files uploaded by users possessing administrator privileges. This could allow for unauthorized access or manipulation of...

PT-2025-30348 · Unknown · Haxcms-Nodejs

Name of the Vulnerable Software and Affected Versions: HAX CMS NodeJs versions 11.0.8 and below Description: HAX CMS NodeJs, a system for managing microsite universes with a NodeJs backend, is susceptible to a crash issue. An authenticated attacker can trigger this issue by sending API requests t...