TencentOS Server 4: python-glance-store (TSSA-2024:0824)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0824 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

WordPress Traffic Monitor plugin <= 3.2.2 - Missing Authorization to Unauthenticated Settings Update vulnerability

Missing Authorization to Unauthenticated Settings Update vulnerability discovered by ch4r0n in WordPress Plugin Traffic Monitor versions = 3.2.2...

Security Bulletin: A vulnerability in Apache Active MQ NMS affects IBM Robotic Process Automation and could result in arbitrary code exections (CVE-2025-29953).

Summary A vulnerability in Apache Active MQ NMS affects IBM Robotic Process Automation and could result in arbitrary code exections CVE-2025-29953. Apache Active MQ is used by IBM Robotic Process automation for integration with Apache Active MQ. This security bulletin identifies the fixes require...

CVE-2025-4228 Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability

An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root...

CVE-2024-44905

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/appendvalue.go...

CVE-2025-5012 Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media'

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'workreaptempuploadtomedia' function in all versions up to, and including, 3.3.2. This makes it possible for...

AlmaLinux 8 : .NET 8.0 (ALSA-2025:8812)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8812 advisory. dotnet: .NET Remote Code Vulnerability CVE-2025-30399 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Note tha...

Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2025-1670)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-1699

An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access...

SUSE-SU-2025:01887-1 Security update for perl-Crypt-OpenSSL-RSA

This update for perl-Crypt-OpenSSL-RSA fixes the following issues: - CVE-2024-2467: Side-channel attack in PKCS1 v1.5 padding mode Marvin Attack bsc1221446...

AlmaLinux 8 : kernel (ALSA-2025:8743)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8743 advisory. kernel: um: Fix out-of-bounds read in LDT setup CVE-2022-49395 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory...

AlmaLinux 8 : glibc (ALSA-2025:8686)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8686 advisory. glibc: static setuid binary dlopen may incorrectly search LDLIBRARYPATH CVE-2025-4802 Tenable has extracted the preceding description block directly from the...

CVE-2025-47089

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

CVE-2025-43574

Adobe Acrobat Reader (DC/Continuous and 2020) versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by CVE-2025-43574, a Use After Free vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening ...

CVE-2025-33069

CVE-2025-33069 affects Windows App Control for Business (WDAC). The root cause is improper verification of cryptographic signatures in WDAC, enabling a local attacker to bypass the security feature. The vulnerability is categorized as a security feature bypass with medium severity (CVSS 3.1: Loca...

CVE-2025-4653

Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105...

CVE-2025-49509

CVE-2025-49509 (Audio Editor & Recorder by Roland Beaussant) is a Missing Authorization vulnerability in Audio Editor & Recorder up to version 2.2.1. The issue stems from incorrectly configured access control security levels, enabling exploitation of unauthorized access to protected functionality...

AIX is vulnerable to an expected behavior violation (CVE-2025-32728) due to OpenSSH

IBM SECURITY ADVISORY First Issued: Tue Jun 10 08:33:35 CDT 2025 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/opensshadvisory19.asc Security Bulletin: AIX is vulnerable to an expected behavior violation CVE-2025-32728 due to OpenSSH...

CVE-2025-49651 Missing Authorization for Interactive Sessions

Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI...

CVE-2025-31061

CVE-2025-31061 describes a reflected XSS in the WordPress Wishlist (Wishlist – WordPress plugin) affecting versions from n/a up to 2.1.0. The issue arises from improper neutralization of input during web page generation, enabling an attacker to inject arbitrary scripts via user-supplied input tha...