PT-2025-15994 · Yii · Yiisoft/Yii

Name of the Vulnerable Software and Affected Versions: yiisoft/yii versions prior to 1.1.31 Description: The issue concerns a Reflected XSS vulnerability in specific scenarios where the fallback error renderer is used. Recommendations: For versions prior to 1.1.31, upgrade yiisoft/yii to version...

User Interface (UI) Misrepresentation of Critical Information

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to User Interface UI Misrepresentation of Critical Information in the GenerateImage function, which does not sanitize URL text. An...

Denial of Service (DoS)

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Denial of Service DoS through the public registration form. Details Denial of Service DoS describes a family of attacks, all aime...

GHSA-PM4J-P7PM-FPVX Apache ActiveMQ Artemis Vulnerable to Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: fro...

Apache ActiveMQ Artemis Vulnerable to Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: fro...

CVE-2025-21848 affecting package kernel for versions less than 6.6.82.1-1

CVE-2025-21848 affecting package kernel for versions less than 6.6.82.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-27391 Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: fro...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana within Instana Agent container image build 292 Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File. An attacker with access to the log files can gain access to Apache Kafka credentials by accessing these application logs. Remediation Upgrade...

CVE-2025-31672

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2025-31672 Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2025-31672

CVE-2025-31672 is an Improper Input Validation issue in Apache POI’s OOXML parsing. The root cause is acceptance of duplicate zip entry names (including paths) within OOXML files (xlsx/docx/pptx), which can cause reads of different data depending on which duplicate entry is chosen. Affects poi-oo...

PT-2025-15848 · Brizy Pro · Brizy Pro

Name of the Vulnerable Software and Affected Versions: Brizy Pro versions 2.6.1 and earlier Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue affects Brizy Pro, enabling Cross Site Request Forgery. Recommendations: For...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through the quoteNameStr method. An attacker can manipulate SQL queries and retrieve or alter information in the database by injecting malicious SQL code. Note: This is only exploitable if classes extending the affected...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal due to the handling of TemporaryFileOperationStatus in TemporaryFileControllerBase.cs and TemporaryFileService.cs. An attacker can upload files to unintended locations to cause disruption of service to other user...

Access Control Bypass

Overview shopware/core is a Shopware platform is the core for all Shopware ecommerce products. Affected versions of this package are vulnerable to Access Control Bypass due to improper access control mechanisms. An attacker can access documents of other customers by guessing the deepLinkCode of a...

Access Control Bypass

Overview shopware/platform is a Shopware e-commerce core. Affected versions of this package are vulnerable to Access Control Bypass due to improper access control mechanisms. An attacker can access documents of other customers by guessing the deepLinkCode of a document. Remediation Upgrade...

Improper Input Validation

Overview shopware/platform is a Shopware e-commerce core. Affected versions of this package are vulnerable to Improper Input Validation via the password length. This is by submitting excessively long passwords through Storefront forms or Store-API. Remediation Upgrade shopware/platform to version...

PT-2025-15436

Name of the Vulnerable Software and Affected Versions c-ares versions 1.32.3 through 1.34.4 Node.js versions prior to 22.15.0 Description A use-after-free vulnerability exists in the read answers function of c-ares, a library used for asynchronous DNS resolution. This occurs when process answer m...

Debian dsa-5897 : lemonldap-ng - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5897 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5897-1 [email protected] https://www.debian.org/security/ Moritz...