CVE-2025-1181

A flaw was found in GNU Binutil. This vulnerability allows memory corruption via manipulation of the bfdelfgcmarkrsec function. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use...

Schneider Electric EcoStruxure (Update A)

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

CVE-2025-1147

A flaw was found in GNU Binutils nm component. This vulnerability allows a buffer overflow via manipulation of the const argument. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of u...

GHSA-79F6-P65J-3M2M MobSF Local Privilege Escalation

Product: Mobile Security Framework MobSF Version: 4.3.0 CWE-ID: CWE-269: Improper Privilege Management CVSS vector v.4.0: 7.1 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N CVSS vector v.3.1: 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Description: MobSF has a functionality of dividing users ...

Fedora 40 : fastd (2025-29fc4fefd5)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-29fc4fefd5 advisory. This release contains a number of small improvements and bugfixes, including mitigations for the LOW severity vulnerability CVE-2025-24356. Bugfixes - Add...

PT-2025-3931 · Mozilla +8 · Thunderbird +8

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 128.7 Thunderbird versions prior to 135 Description: The issue arises when the From field of an email uses invalid group name syntax. This results in Thunderbird displaying an incorrect sender address...

CVE-2025-1003 HP Anyware Agent for Linux – Potential Authentication Bypass

A potential vulnerability has been identified in HP Anyware Agent for Linux which might allow for authentication bypass which may result in escalation of privilege. HP is releasing a software update to mitigate this potential vulnerability...

CVE-2025-21518

CVE-2025-21518 affects Oracle MySQL Server, specifically the Server: Optimizer component (also listed with related Oracle MySQL Server entries). Affected versions are 8.0.40 and prior, 8.4.3 and prior, and 9.1.0 and prior. The vulnerability is exploitable by a low-privilege, network-accessing att...

How to Address CVE-2025-21307 Without a Patch Before the Weekend

Microsoft’s January 2025 Patch Tuesday release addresses a critical vulnerability—CVE-2025-21307—in the Windows Reliable Multicast Transport Driver RMCAST. With a CVSS score of 9.8, this vulnerability poses a severe threat and is highly susceptible to exploitation. What is CVE-2025-21307? RMCAST ...

CVE-2025-21172

A remote code execution vulnerability was found in .NET. This flaw allows an attacker to load a specially crafted file in .NET. Mitigation Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affecte...

CVE-2024-12086

A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare wi...

Schneider Electric EcoStruxure Power Build Rapsody

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

CVE-2024-56709

In the Linux kernel, the following vulnerability has been resolved: iouring: check if iowq is killed before queuing task work can be executed after the task has gone through iouring termination, whether it's the final taskwork run or the fallback path. In this case, task work will find -iowq bein...

Fedora: Security Advisory (FEDORA-2024-4808dce926)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-56337

TOCTOU Race Condition in Apache Tomcat (CVE-2024-56337) affects 11.0.0-M1–11.0.1, 10.1.0-M1–10.1.33, and 9.0.0.M1–9.0.97. The issue stems from TOCTOU vulnerability during JSP compilation/default servlet write on case-insensitive file systems. Incomplete mitigation previously for CVE-2024-50379; g...

CVE-2024-56145

Craft CMS is affected by CVE-2024-56145 due to a code execution vector triggered when php.ini register_argc_argv is enabled. Reports indicate an RCE vulnerability exists in affected versions, with remediation via upgrading to Craft CMS 3.9.14, 4.13.2, or 5.5.2. If upgrading is not possible, the r...

CISCO-SA-20180207-CPS

creationtimestamp| type| source ---|---|--- 2024-12-17 06:40:42+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113666792779739071...

PT-2024-32098 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: Artifex Software mupdf version 1.24.9 Description: A segmentation fault was discovered in the /tools/pdfextract.c component, allowing attackers to cause a Denial of Service DoS via a crafted PDF file. The issue is related to the pdfextract.c...

CVE-2024-53860 Potential Abuse for Sending Arbitrary Emails in sp-php-email-handler

sp-php-email-handler is a PHP package for handling contact form submissions. Messages sent using this script are vulnerable to abuse, as the script allows anybody to specify arbitrary email recipients and include user-provided content in confirmation emails. This could enable malicious actors to...

Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

Drupal core contains a potential PHP Object Injection vulnerability that if combined with another exploit could lead to Artbitrary File Deletion. It is not directly exploitable. This issue is mitigated by the fact that in order to be exploitable, a separate vulnerability must be present that allo...