CVE-2024-56602 affecting package kernel for versions less than 6.6.76.1-1

CVE-2024-56602 affecting package kernel for versions less than 6.6.76.1-1. An upgraded version of the package is available that resolves this issue...

Security Bulletin: Vulnerabilities in Eclipse jetty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.

Summary Potential vulnerabilities in Eclipse Jetty has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. The vulnerability have been addressed. Refer to details for additional information...

CVE-2025-26597 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-1

CVE-2025-26597 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-23359 affecting package nvidia-container-toolkit for versions less than 1.17.4-1

CVE-2025-23359 affecting package nvidia-container-toolkit for versions less than 1.17.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-27423 affecting package vim for versions less than 9.1.1164-1

CVE-2025-27423 affecting package vim for versions less than 9.1.1164-1. An upgraded version of the package is available that resolves this issue...

PHP 8.2.x < 8.2.28 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.2.28. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.28 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via authoritative subdomain cookie overwrite. An attacker controlling a subdomain under the parent domain can set cookies scoped to the...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to differences in XML document DOCTYPE parsing between REXML and Nokogiri, implemented in xmlsecurity.rb. An attacker can bypass authentication via Signature Wrapping attack...

Deserialization of Untrusted Data

Overview github.com/cosmos/ibc-go/v10/modules/core/04-channel/keeper is an interblockchain communication protocol IBC implementation in Golang built as a SDK module. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to inconsistencies in the deserialization...

[SECURITY] [DSA 5877-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5877-1 [email protected] https://www.debian.org/security/ Andres Salomon March 12, 2025 https://www.debian.org/security/faq -...

CVE-2025-27017 Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials...

CVE-2025-27017 Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials...

CVE-2025-27867 Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Felix HTTP Webconsole Plugin. This issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0. Users are recommended to upgrade to version 1.2.2, which fixes the issue...

CVE-2025-27867 Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Felix HTTP Webconsole Plugin. This issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0. Users are recommended to upgrade to version 1.2.2, which fixes the issue...

CVE-2025-27867

The CVE-2025-27867 entry concerns an XSS flaw in the Apache Felix HTTP Webconsole Plugin. Affected versions are 1.X through 1.2.0; the root cause is improper neutralization of input during web page generation. Impact is consistent with a Cross-Site Scripting risk affecting users of the Webconsole...

HTTP Request Smuggling

Overview io.ktor:ktor-network-tls is a framework for quickly creating web applications in Kotlin with minimal effort. Affected versions of this package are vulnerable to HTTP Request Smuggling due to a race condition between multiple coroutines using the same thread. Remediation Upgrade...

SUSE CVE-2025-24813

Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through...

SQL Injection

Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to SQL Injection via the getRelationFilterCondition method. Remediation Upgrade pimcore/pimcore to version 11.5.4 or higher. References - GitHub Commit -...

Improper Authentication

Overview Microsoft.AspNetCore.App.Runtime.win-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Improper Authentication in the RefreshSignInAsync...

Security Bulletin: The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses affects watsonx.data

Summary The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses, which may impact watsonx.data. Vulnerability Details CVEID:CVE-2024-53990 DESCRIPTION: The AsyncHttpClient AHC library allows Java applications to easily...