CVE-2025-1688 System configuration password reset

Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after the upgrading from older versions using specific installers. The system configuration password is an additional, optional protection that is enabled on the...

RHEL 7 : fluentd (RHSA-2018:2225)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:2225 advisory. Fluentd is an open source data collector designed to scale and simplify log management. It can collect, process and ship many kinds of data in near...

Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2025-105-01)

The version of mozilla-thunderbird installed on the remote host is prior to 128.9.2esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-105-01 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues...

CVE-2025-3590

CVE-2025-3590 affects the Adianti Framework up to version 8.0. The vulnerability is a deserialization flaw in an unknown functionality, allowing remote exploitation. The exploit has been disclosed publicly. Remediation: upgrade to Adianti Framework 8.1, which addresses the issue. The public detai...

GHSA-472W-7W45-G3W5 Pleezer resource exhaustion through uncollected hook script processes

Impact Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In affected versions, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table. Even during normal usage, every track change an...

Exploit for Path Traversal in Ghost

CVE-2023-40028 POC for CVE-2023-40028: Ghost CMS Arbitrary Fil...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Authorization in that a user with the "Edit Other Users" permission set, but not broader high-level permissions, can modify the properti...

PT-2025-16279 · Autogpt · Autogpt

Name of the Vulnerable Software and Affected Versions: AutoGPT versions prior to 0.6.1 Description: The AutoGPT Platform's WebSocket API transmitted node execution updates to subscribers based on the graph id+graph version. However, there was no check prohibiting users from subscribing with anoth...

CVE-2025-32027

Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher...

Improper Encoding or Escaping of Output

Overview mediawiki/core is a Free software wiki application developed by the Wikimedia Foundation and others. Note: This package is not maintained on Packagist anymore, but newer releases exist. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the fee...

CVE-2025-29915

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AFPACKET defrag option is enabled by default and allows AFPACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is bas...

CVE-2025-29915 Suricata af-packet: defrag option can lead to truncated packets affecting visibility

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AFPACKET defrag option is enabled by default and allows AFPACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is bas...

CVE-2025-22232 Spring Cloud Config Server May Not Use Vault Token Sent By Clients

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: You have Spring Vault on the classpath of your Spring Cloud Config Server and You are using the...

CVE-2025-22232

Summary: CVE-2025-22232 affects Spring Cloud Config Server when used with Vault and X-CONFIG-TOKEN. The issue arises because the default SessionManager (LifecycleAwareSessionManager or similar) persists the first Vault token it retrieves and continues using it, even if clients send a different to...

Security Bulletin: IBM QRadar Wincollect agent is vulnerable to denial of service ( CVE-2024-51461)

Summary IBM QRadar Wincollect agent is vulnerable to denial of service. The vulnerability have been addressed in the latest update. Vulnerability Details CVEID:CVE-2024-51461 DESCRIPTION: IBM QRadar WinCollect Agent could allow a remote attacker to cause a denial of service by interrupting an HTT...

CVE-2025-32027

CVE-2025-32027 affects the Yii PHP framework (yiisoft/yii) prior to 1.1.31. The issue is a Reflected XSS vulnerability that occurs in certain scenarios when the fallback error renderer is used. Impact is limited to scenarios described in the advisory; no exploitation details are provided in the s...

Security Bulletin: IBM Sterling Control Center is affected by sensitive information within URLs may be logged (CVE-2023-43035)

Summary Sensitive information may be logged Session token is passing in the URL within URLs is affecting IBM Sterling Control Center v6.2.1.0, v6.3.1.0 and v6.4.0.0. Customers must upgrade to latest patch below to address this vulnerability. Vulnerability Details CVEID:CVE-2023-43035 DESCRIPTION:...

Moodle 3.11.x < 3.11.16 JQuery UI Library Upgrade

According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.23 or 3.11.x prior to 3.11.16. The JQuery UI library included with Moodle has been upgraded to version 1.13.2, which includes fixes for multiples security issues. Note that the scanner has not...

Moodle < 3.9.23 phpCAS Library Upgrade

According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.23, 3.11.x prior to 3.11.16 or 4.0.x prior to 4.0.10. The phpCAS library included with Moodle has been upgraded to version 1.6.0, which includes a fix for a serious security issue. Note that the...

Moodle 4.0.x < 4.0.10 phpCAS Library Upgrade

According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.23, 3.11.x prior to 3.11.16 or 4.0.x prior to 4.0.10. The phpCAS library included with Moodle has been upgraded to version 1.6.0, which includes a fix for a serious security issue. Note that the...