Debian dla-4121 : phpmyadmin - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4121 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4121-1 [email protected]...

Apache Airflow Common SQL Provider Vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter which was a recommended pattern, Authenticated UI User could inject arbitrary SQL command...

CVE-2025-30473 Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter which was a recommended pattern, Authenticated UI User could inject arbitrary SQL command...

CVE-2025-30473 Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter which was a recommended pattern, Authenticated UI User could inject arbitrary SQL command...

CVE-2025-30473

CVE-2025-30473 affects the Apache Airflow Common SQL Provider (before 1.24.1). The issue is an SQL Injection in the use of the partition_clause parameter of SQLTableCheckOperator, enabling an authenticated UI user to inject arbitrary SQL commands when triggering DAGs that expose partition_clause....

Arbitrary File Upload

Overview Kentico.Xperience.Libraries is a package for libraries and applications that use Kentico Xperience API. Affected versions of this package are vulnerable to Arbitrary File Upload due to the TryZipProviderSafe process. An attacker can create files with unauthorized extensions by exploiting...

[SECURITY] [DLA 4116-1] abseil security update

Debian LTS Advisory DLA-4116-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost April 05, 2025 https://wiki.debian.org/LTS Package : abseil Version : 020200923.3-2+deb11u1 CVE ID : CVE-2025-0838 Debian Bug : 1098903 A vulnerability has been found in abseil, a collecti...

SUSE-SU-2025:1143-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: - CVE-2024-45337: golang.org/x/crypto/ssh: Fixed misuse of ServerConfig.PublicKeyCallback leading to authorization bypass bsc1234563. Other fixes: - Updated to version 20250327.01 bsc1239763, bsc1239866 Remove error messages from...

XXE (XML External Entity Injection) org.codehaus.jackson:jackson-mapper-asl Dependency in Confluence Data Center and Server

This High severity XXE XML External Entity Injection org.codehaus.jackson:jackson-mapper-asl Dependency vulnerability was introduced in versions 8.5 of Confluence Data Center and Server. This org.codehaus.jackson:jackson-mapper-asl Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS...

CVE-2025-3199 ageerle ruoyi-ai API Interface SysModelController.java improper authorization

A vulnerability was found in ageerle ruoyi-ai up to 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysModelController.java of the component API Interface. The manipulati...

CVE-2025-30676

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19. Users are recommended to upgrade to version 18.12.19, which fixes the issue...

CVE-2024-53868 Apache Traffic Server: Malformed chunked message body allows request smuggling

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes the issue...

CVE-2024-53868

Apache Traffic Server is affected by CVE-2024-53868: request smuggling when chunked messages are malformed. Affected versions are 9.2.0–9.2.9 and 10.0.0–10.0.4. The issue is mitigated by upgrading to 9.2.10 or 10.0.5, which contain the fix. Impact is described as high (I), with no confidentiality...

PT-2025-14780 · Projeqtor · Projeqtor

Name of the Vulnerable Software and Affected Versions: Projeqtor versions up to 12.0.2 Description: A critical issue affects some unknown functionality of the file /tool/saveAttachment.php, where the manipulation of the attachmentFiles argument leads to unrestricted upload. The attack can be...

CVE-2025-1734 affecting package php for versions less than 8.3.19-1

CVE-2025-1734 affecting package php for versions less than 8.3.19-1. An upgraded version of the package is available that resolves this issue...

Security update for warewulf4

This update for warewulf4 fixes the following issues: warewulf4 was updated from version 4.5.8 to 4.6.0: Security issues fixed for version 4.6.0: CVE-2025-22869: Fixed Denial of Service vulnerability in the Key Exchange of golang.org/x/crypto/ssh bsc1239322 CVE-2025-22870: Fixed proxy bypass usin...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation due to the handling of the PROXY command. An attacker can spoof their IP address by sending multiple PROXY commands, with later ones overriding earlier ones. Note: This is only exploitable if ProxyOn is enabled...

CVE-2025-1734 affecting package php for versions less than 8.1.32-1

CVE-2025-1734 affecting package php for versions less than 8.1.32-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-45338 affecting package packer for versions less than 1.9.5-7

CVE-2024-45338 affecting package packer for versions less than 1.9.5-7. An upgraded version of the package is available that resolves this issue...

Private Data Structure Returned From A Public Method

Overview Affected versions of this package are vulnerable to Private Data Structure Returned From A Public Method. When a user accesses an externally referenced image, the provider of the image may obtain private information about the IP address of that accessing user. Remediation Upgrade...