Security Bulletin: IBM Sterling Connect:Direct Web Services vulnerable to spring-context-6.2.3.jar (CVE-2025-22233)

Summary IBM Sterling Connect:Direct Web Services uses spring-context-6.2.3.jar, which has vulnerability CVE-2025-22233. This has been addressed in fixpacks that are available on Fix Central. Vulnerability Details CVEID:CVE-2025-22233 DESCRIPTION: CVE-2024-38820 ensured Locale-independent, lowerca...

AWS VDP: Remote Code Execution in Amazon MWAA due to outdated Apache Airflow version

Explanation: I am a penetration tester working with Siemens. During a collaborative security assessment with an internal team, I discovered a Remote Code Execution RCE vulnerability in an Amazon Managed Workflows for Apache Airflow MWAA environment. I initially reported this issue to the AWS...

CVE-2025-20286

A vulnerability in Amazon Web Services AWS, Microsoft Azure, and Oracle Cloud Infrastructure OCI cloud deployments of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configuration...

Vulnerability fixed in Cisco Identity Services Engine for cloud platforms

Cisco has fixed a vulnerability in Identity Services Engine ISE for cloud platforms. The vulnerability involves a flaw in automatic password generation when Cisco ISE is installed on a cloud platform. This causes the same passwords to be used in different ISE cloud environments. This allows an...

CVE-2025-20286

A vulnerability in Amazon Web Services AWS, Microsoft Azure, and Oracle Cloud Infrastructure OCI cloud deployments of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configuration...

CVE-2025-20286

A vulnerability in Amazon Web Services AWS, Microsoft Azure, and Oracle Cloud Infrastructure OCI cloud deployments of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configuration...

CVE-2025-20286

CVE-2025-20286 concerns Cisco Identity Services Engine (ISE) deployed on cloud platforms (AWS, Azure, OCI). The root cause is improper credential generation that causes different ISE deployments using the same credentials when the software release and cloud platform are identical. An unauthentica...

WSO2 API Manager 代码问题漏洞

WSO2 API Manager is a suite of API lifecycle management solutions from US-based WSO2. A security vulnerability exists in WSO2 API Manager that stems from improper validation of user input in the SOAP management service, which could lead to arbitrary file uploads...

CVE-2025-2500

A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gain unauthorized access to the product and the time window of a possible password attack could be expanded...

[SECURITY] Fedora 42 Update: python-tornado-6.4.1-3.fc42

Tornado is an open source version of the scalable, non-blocking web server and tools. The framework is distinct from most mainstream web server frameworks and certainly most Python frameworks because it is non-blocking and reasonably fast. Because it is non-blocking and uses epoll, it can handle...

CVE-2025-2500

A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gain unauthorized access to the product and the time window of a possible password attack could be expanded...

CVE-2025-2500

CVE-2025-2500 affects Hitachi Energy Asset Suite SOAP Web services. Public documentation indicates a vulnerability in SOAP-based interfaces that could allow an attacker to gain unauthorized access and potentially extend the window for password attacks. Reported CVSS data (3.1: High, 7.4; 4.0: Cri...

CVE-2025-2500

A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gain unauthorized access to the product and the time window of a possible password attack could be expanded...

CVE-2025-2500

A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gain unauthorized access to the product and the time window of a possible password attack could be expanded...

PT-2025-23284 · Unknown · Asset Suite

Name of the Vulnerable Software and Affected Versions: Asset Suite versions affected versions not specified Description: A vulnerability exists in the SOAP Web services, allowing an attacker to gain unauthorized access to the product if successfully exploited. This could also expand the time wind...

CVE-2025-40671

SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘fkremotocentral’ parameter on the ‘/webservices/articles.php’ endpoint...

aws-mcp-server 操作系统命令注入漏洞

aws-mcp-server is a lightweight service by Alexei Ledenev Personal Developer that enables AI assistants to execute AWS CLI commands in a secure containerized environment via the Model Context Protocol MCP. A security vulnerability exists in aws-mcp-server that stems from command injection and cou...

CVE-2025-40671

Gestnet v1.07 by AES Multimedia has an SQL injection vulnerability exposed via the fk_remoto_central parameter on the /webservices/articles.php endpoint. Exploitation could allow an attacker to retrieve, create, update, and delete databases, indicating high impact on confidentiality, integrity, a...

AES Multimedia Gestnet 注入漏洞

AES Multimedia Gestnet is a contracted software from AES Multimedia. An injection vulnerability exists in AES Multimedia Gestnet version v1.07, which stems from an incorrect operation of the parameter fkremotocentral in the file /webservices/articles.php resulting in SQL injection...

CVE-2025-21569

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion component: Web Services. The supported version that is affected is 11.2.19.0.000. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...