Chromium: Monthly Vulnerability Update (March 2025)

Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop25.html...

laravel-crud-wizard-free has File Validation Bypass

Impact Medium Patches Version 3.4.17 fixes illuminate/validation v 8.0.0 to 11.44.0 Workarounds Register \MacropaySolutions\LaravelCrudWizard\Providers\ValidationServiceProvider instead of Illuminate\Validation\ValidationServiceProvider::class if you are using illuminate/validation 11.44.1...

PT-2025-11005

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the fixed version Description: A double accounting race condition has been identified in the Linux kernel when btrfs run delalloc range fails. This issue can cause the kernel to crash, resulting in a...

PT-2025-11032 · Bitdefender · Bitdefender Box

Name of the Vulnerable Software and Affected Versions: Bitdefender Box 1 version 1.3.11.490 Description: A command injection vulnerability exists in the "/check image and trigger recovery" API endpoint, allowing an unauthenticated, network-adjacent attacker to execute arbitrary commands on the...

PT-2025-11128

Name of the Vulnerable Software and Affected Versions: ruby-saml versions prior to 1.12.4 and 1.18.0 Description: The issue is related to the ruby-saml library, which provides security assertion markup language SAML single sign-on SSO for Ruby. The library is susceptible to remote Denial of Servi...

Dummy Issue

h3. Issue Summary This issue is created to test the automation rule to restrict the access level in case of a security bug. h3. Steps to Reproduce Dummy step 1 Dummy step 2 h3. Expected Results Dummy h3. Actual Results The below exception is thrown in the xxxxxxx.log file: noformat ... noformat h...

PT-2025-10798 · Microsoft · Windows Remote Desktop Services +1

Name of the Vulnerable Software and Affected Versions: Windows Remote Desktop Services versions prior to the fixed version Description: The issue is related to the storage of sensitive data in improperly locked memory in Windows Remote Desktop Services, allowing an unauthorized attacker to execut...

PT-2025-17553 · Totolink · Totolink A810R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A810R version 4.1.2cu.5182 B20201026 Description: A stack overflow issue was discovered via the startTime and endTime parameters in the setParentalRules function. Recommendations: For TOTOLINK A810R version 4.1.2cu.5182 B20201026, as...

PT-2025-10752 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: A problem was found in the rename function of the /admin/file/rename.do file in the org.marker.mushroom.controller.FileController component. The manipulation of the name/path argument leads to cross-site...

PT-2025-10791 · Adobe · Substance3D - Designer

Name of the Vulnerable Software and Affected Versions: Substance3D - Designer versions 14.1 and earlier Description: The issue is a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction,...

PT-2025-10818 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel versions prior to the fixed version Microsoft Office Online Server version 1.0.0 Description: The issue is a stack-based buffer overflow in Microsoft Office Excel, allowing an unauthorized attacker to execute arbitrary...

PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()

Impact Due to lack of limits by default in the explode function, malicious clients were able to abuse some packets to waste server CPU and memory. This is similar to a previous security issue published in https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672, but with a...

CVE-2025-27615 umatiGateway's UI publicly accessible in provided docker-compose file

umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit...

CVE-2025-27615 umatiGateway's UI publicly accessible in provided docker-compose file

umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit...

PT-2025-10590

Name of the Vulnerable Software and Affected Versions HDF5 version 1.14.6 Description A critical issue was found in the H5SM delete function of the h5 File Handler component, located in the H5SM.c file. This issue leads to a heap-based buffer overflow. The attack can be launched remotely, but it...

PT-2025-10576

Name of the Vulnerable Software and Affected Versions PyTorch version 2.6.0+cu124 Description A critical vulnerability was found in the function torch.ops.profiler. call end callbacks on jit fut of the component Tuple Handler. The manipulation of the argument None leads to memory corruption. The...

PT-2025-10578

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3 Description A critical issue was found in the Open Asset Import Library Assimp, affecting the Assimp::GetNextLine function in the ParsingUtils.h library of the File Handler component. This issue...

PT-2025-10589

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp version 5.4.3 Description A critical issue has been found in the Open Asset Import Library Assimp, affecting the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp in the File Handler...

PT-2025-10451 · Geshi +1 · Geshi +1

Name of the Vulnerable Software and Affected Versions: GeSHi versions up to 1.0.9.1 Description: A problematic issue has been found in GeSHi, affecting the get var function of the /contrib/cssgen.php file in the CSS Handler component. The manipulation of the...

PT-2025-10038 · Unknown · Projectworlds Life Insurance Management System

Name of the Vulnerable Software and Affected Versions: Projectworlds Life Insurance Management System version 1.0 Description: A critical vulnerability has been found in the Projectworlds Life Insurance Management System. This issue affects the file /updateAgent.php, where the manipulation of the...