VMware Aria Automation SSRF (VMSA-2025-0001)

The VMware Aria Automation application running on the remote host is affected by a vulnerability as referenced in the VMSA-2025-0001 advisory. - VMware Aria Automation contains a server-side request forgery SSRF vulnerability. A malicious actor with 'Organization Member' access to Aria Automation...

CVE-2025-22761 WordPress Ajax Contact Form plugin <= 1.2.5.1 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Olaf Lederer Ajax Contact Form allows Stored XSS.This issue affects Ajax Contact Form: from n/a through 1.2.5.1...

acct (>=0.2.0, <=0.5.0), acid-store (>=0.8.0, <=0.14.2) +277 more potentially affected by CVE-2025-5791 via users (>=0.8.1, <=0.11.0)

users CARGO version =0.8.1, =0.2.0, =0.8.0, =0.4.0, =4.1.0, =0.1.0, =1.0.0, =0.1.0, =1.1.0, =0.3.0, =0.3.0, =0.3.0, =0.9.0, =0.9.0, =0.1.0, =0.1.1 and more Source cves: CVE-2025-5791 Source advisory: OSV:RUSTSEC-2025-0040...

GHSA-446M-HMMM-HM8M

creationtimestamp| type| source ---|---|--- 2025-01-14 19:09:21+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/1563...

CVE-2025-21217

Windows NTLM Spoofing Vulnerability...

Fortinet Fortigate Integer Overflow in ipsec ike (FG-IR-24-267)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-267 advisory. - An Integer Overflow or Wraparound vulnerability CWE-190 in version 7.4.4 and below, version 7.2.10 and below; FortiSASE...

Huawei EulerOS: Security Advisory for ghostscript (EulerOS-SA-2025-1004)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fortinet Fortigate Out-of-bounds Write in IPSEC Daemon (FG-IR-24-373)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-373 advisory. - A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16,...

Fedora 40 : libxmp (2025-c58133e520)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c58133e520 advisory. Latest upstream release. Changelog: Fixes: CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbisdeinit CVE-2023-45680: Null...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Go Networking vulnerability (USN-7197-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7197-1 advisory. Guido Vranken discovered that Go Networking handled input to the Parse functions inefficiently. An attacke...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2025-20007)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20007 advisory. 4.1.12-124.93.1 - cachefiles: fix memory leak in cachefilesaddcache Baokun Li Orabug: 36544657 CVE-2024-26840 Tenable has extracted the preceding descripti...

Duplicate Advisory: Stored XSS in REDAXO

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7wj8-856p-qc9m. This link is maintained to preserve external references. Original Description A vulnerability was found in Redaxo CMS 5.18.1. It has been classified as problematic. Affected is an unknown functio...

CVE-2024-9523

creationtimestamp| type| source ---|---|--- 2025-01-09 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-023/...

Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2025-795)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-795 advisory. Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the...

RockyLinux 8 : python-requests (RLSA-2025:0012)

The remote RockyLinux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2025:0012 advisory. requests: subsequent requests to the same host ignore cert verification CVE-2024-35195 Tenable has extracted the preceding description block directly from the...

ABB Cylon Aspect 3.08.03 webServerDeviceLabelUpdate.php Denial of Service Vulnerability

ABB Cylon Aspect version 3.08.03 suffers from an authenticated arbitrary content injection vulnerability in the webServerDeviceLabelUpdate.php script due to a lack of input validation. Authenticated attackers can exploit the deviceLabel POST parameter to write arbitrary content to a fixed file...

ABB Cylon Aspect 3.08.02 Cookie User Password Disclosure Vulnerability

ABB Cylon Aspect version 3.08.02 suffers from cleartext transmission and storage of sensitive information in a Cookie. This includes the globals parameter, where authdata contains base64-encoded credentials. A remote attacker can intercept the HTTP Cookie, including authentication credentials,...

CVE-2024-13047

creationtimestamp| type| source ---|---|--- 2024-12-30 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1731/ 2024-12-30 20:49:30+00:00| seen| https://infosec.exchange/users/cve/statuses/113743741879163553 2024-12-30 22:39:09+00:00| seen| https://t.me/cvedetector/13952...

ABB Cylon Aspect 3.08.02 (clearProjectConfigurationAjax.php) Remote Code Execution

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an authenticated blind OS...

Fedora 41 : incus (2024-0912cd3ad9)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0912cd3ad9 advisory. Update to 6.8 to get various features and fixes Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...