CVE ID : CVE-2025-53367

Published : July 3, 2025, 9:15 p.m. | 2 hours, 5 minutes ago

Description : DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-5322

Published : July 3, 2025, 10:15 p.m. | 1 hour, 5 minutes ago

Description : The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updatecar and createcar functions in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site’s server, which may make remote code execution possible.

Severity: 7.2 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

GIMP 3.2 will include a new Overwrite painting mode, support for Photoshop pattern files, and expanded file format support. You’re…

fstl-e is a fast, easy to use stl file viewer. It is a fork of fstl with some fancy enhancements.…

DjVuLibre version 3.5.29 was released today. It fixes CVE-2025-53367 (GHSL-2025-055), an out-of-bounds (OOB) write in the MMRDecoder::scanruns method. The vulnerability…

Need an efficient way to manage your fonts? Step forward a dedicated font manager utility. The post 5 Best Free…

Apache Tomcat and Camel Vulnerabilities Actively Exploited in The Wild

Critical vulnerabilities in Apache Tomcat and Apache Camel are being actively exploited by cybercriminals worldwide, with security researchers documenting over 125,000 attack attempts across more than …
Read more

Published Date:
Jul 03, 2025 (3 hours, 47 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-29891

CVE-2025-24813

CVE-2025-27636

Grafana releases critical security update for Image Renderer plugin

Grafana Labs has addressed four Chromium vulnerabilities in critical security updates for the Grafana Image Renderer plugin and Synthetic Monitoring Agent.
Although the issues impact Chromium and were …
Read more

Published Date:
Jul 03, 2025 (3 hours, 36 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-6554

CVE-2025-6192

CVE-2025-6191

CVE-2025-5959

CVE ID : CVE-2025-45938

Published : July 3, 2025, 3:15 p.m. | 4 hours, 4 minutes ago

Description : Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName parameter.

Severity: 5.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-53490

Published : July 3, 2025, 4:15 p.m. | 3 hours, 4 minutes ago

Description : Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Wikimedia Foundation Mediawiki – CampaignEvents Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki – CampaignEvents Extension: from 1.43.X before 1.43.2.

Severity: 5.6 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-48939

Published : July 3, 2025, 5:15 p.m. | 2 hours, 3 minutes ago

Description : tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual

CVE ID : CVE-2025-53489

Published : July 3, 2025, 5:15 p.m. | 2 hours, 3 minutes ago

Description : Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Wikimedia Foundation Mediawiki – GoogleDocs4MW Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki – GoogleDocs4MW Extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Severity: 5.6 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-53500

Published : July 3, 2025, 5:15 p.m. | 2 hours, 3 minutes ago

Description : Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Wikimedia Foundation Mediawiki – MassEditRegex Extension allows Stored XSS.This issue affects Mediawiki – MassEditRegex Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Severity: 5.6 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-49846

Published : July 3, 2025, 5:15 p.m. | 2 hours, 3 minutes ago

Description : wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that were visible in the view port have been logged to the iOS system logs in clear text. Wire application logs created and managed by the application itself were not affected, especially not the logs users can export and send to Wire support. The iOS logs can only be accessed if someone had (physical) access to the underlying unlocked device. The issue manifested itself by calling canOpenUrl() and passing an invalid URL object. When iOS then performs the check and fails, it logs the contents to the system log. This is not documented behaviour. Wire released an emergency fix with version 3.124.1. As a workaround, users can reset their iOS device to remove the offending logs. Since Wire cannot access or modify iOS system logs, there’s no other workaround other than a reset.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-53501

Published : July 3, 2025, 5:15 p.m. | 2 hours, 3 minutes ago

Description : Improper Access Control vulnerability in Wikimedia Foundation Mediawiki – Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Authorization.This issue affects Mediawiki – Scribunto Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-6071

Published : July 3, 2025, 5:15 p.m. | 2 hours, 3 minutes ago

Description : Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE.

An attacker can gain access to salted information to decrypt MQTT information.
This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016.

Severity: 5.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-53502

Published : July 3, 2025, 5:15 p.m. | 2 hours, 3 minutes ago

Description : Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki – FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki – FeaturedFeeds Extension: 1.39.X, 1.42.X, 1.43.X.

Severity: 6.5 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-6072

Published : July 3, 2025, 5:15 p.m. | 2 hours, 3 minutes ago

Description : Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE.

When the REST interface is enabled by the user, and an attacker gains access to
the control network, and CVE-2025-6074 is exploited, the attacker can use the
JSON configuration to overflow the date of expiration field.This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016.

Severity: 7.5 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-6074

Published : July 3, 2025, 5:15 p.m. | 2 hours, 3 minutes ago

Description : Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE.

When the REST interface is enabled by the user, and an attacker gains access to
source code and control network, the attacker can bypass the REST interface authentication and gain access to MQTT configuration data.

This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016.

Severity: 6.5 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-6073

Published : July 3, 2025, 5:15 p.m. | 2 hours, 3 minutes ago

Description : Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE.

When the REST interface is enabled by the user, and an attacker gains access to
the control network, and user/password broker authentication is enabled, and
CVE-2025-6074 is exploited, the attacker can overflow the buffer for username or
password.

This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016.

Severity: 7.5 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…