Oracle E-Business Suite (EBS) is a comprehensive suite of integrated business applications that enable organizations to make better decisions, reduce costs, and increase performance. It covers a wide range of business functions, including financials, supply chain management, human resources, customer relationship management, procurement, project management, and more.

Oracle E-Business Suite

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2025-61882

Linux

Linux Kernel

Redis is a data structure server. It is open-source, networked, in-memory, and stores keys with optional durability.

Redis

Valkey is a high-performance, open-source, in-memory data store used as a database, cache, and message broker. It is a community-driven fork of Redis, created in 2024 after Redis changed its license to a more restrictive model. Valkey retains full Redis compatibility and remains under the permissive BSD license, ensuring it's free and open-source for all use cases.

Valkey

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Linux Debian

Ubuntu is a Linux distribution based on Debian, mostly composed of free and open-source software. Ubuntu is officially released in three editions: Desktop, Server, and Core for internet of things devices and robots. All the editions can run on the computer alone or in a virtual machine.

Linux Ubuntu

Fedora is a popular open-source, Linux-based operating system.

Linux Fedora

Red Hat Enterprise Linux is a Linux distribution developed by Red Hat for the commercial market.

Linux Red Hat

Linux openSUSE

The Amazon Linux is a supported and maintained Linux image provided by Amazon Web Services for use on Amazon Elastic Compute Cloud (Amazon EC2).

Amazon Linux

Alpine Linux is a Linux distribution based on musl and BusyBox, designed for security, simplicity, and resource efficiency.

Linux Alpine

Oracle Linux is a Linux distribution packaged and freely distributed by Oracle, available partially under the GNU General Public License since late 2006. It is compiled from Red Hat Enterprise Linux source code, replacing Red Hat branding with Oracle's.

Linux Oracle

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

CVE-2025-49844

Alpine

Alpine Security Tracker

CBL-Mariner

CBL Mariner

Debian

Debian Security Tracker

Homebrew

MinimOS

Minimus

NixOS

Red Hat

Red Hat Errata

Ubuntu

Ubuntu Security Tracker

Cisco Adaptive Security Appliance (ASA) is a security device that combines firewall, antivirus, intrusion prevention, and virtual private network (VPN) capabilities. It provides proactive threat defense that stops attacks before they spread through the network.

Cisco Adaptive Security Appliance (ASA)

Cisco Firepower Threat Defense (FTD) is a unified software solution that integrates comprehensive network security features, including firewall capabilities, application control, intrusion prevention, and malware protection.

Cisco Firepower Threat Defense (FTD)

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication.
 This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

CVE-2025-20362

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
 This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

CVE-2025-20333

GoAnywhere MFT is a secure managed file transfer (MFT) software solution that allows businesses to securely exchange files with trading partners, customers, and internal systems.

GoAnywhere MFT

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

CVE-2025-10035

Windows

Windows Cumulative Update

Rust is a multi-paradigm programming language focused on performance and safety, especially safe concurrency.

Rust

The safe function `create_ring_buffer` allocates a buffer using `Vec::with_capacity` followed by `set_len`, creating a `Box<[T]>` containing uninitialized memory.
This leads to undefined behavior when functions like `write_slices` create typed slices (e.g., `&mut [bool]`) over the uninitialized memory, violating Rust's validity invariants. The issue has been confirmed using Miri.
Fixed in version 0.2.2 by using `resize_with` to properly initialize the buffer with `T::default()`, adding a `T: Default` bound to ensure sound initialization.

GHSA-fp5x-7m4q-449f

GitHub Advisory Database

The safe function `index_of_ptr` causes undefined behavior when called with an empty slice.
The issue occurs in the line `ptr.add(slice.len() - 1)` which underflows when `slice.len()` is 0, creating a pointer with a massive offset. According to Rust's safety rules, creating such a pointer causes immediate undefined behavior.

GHSA-h5j3-crg5-8jqm

Python is a high-level, general-purpose programming language. Its key feature is the high readability of the code. It supports multiple programming paradigms, including Object-Oriented Programming (OOP) and Functional Programming.

Python

The servicenow config URL is using a generic django View with no authentication.
URL: `/plugins/ssot/servicenow/config/`
### Impact
_What kind of vulnerability is it? Who is impacted?_
An Unauthenticated attacker could access this page to view the Service Now public instance name e.g. `companyname.service-now.com`. This is considered **low-value information**.  This does not expose the Secret, the Secret Name, or the Secret Value for the Username/Password for Service-Now.com. An unauthenticated member would not be able to change the instance name, nor set a Secret. There is not a way to gain access to other pages Nautobot through the unauthenticated Configuration page.
### Patches
_Has the problem been patched? What versions should users upgrade to?_
We highly recommend upgrading to SSoT v3.10.0 which includes this patch.
### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Disable the servicenow SSoT integration

CVE-2025-62607

### Impact
NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations  when NeuVector stores the data.
In the patched version, NeuVector leverages the Kubernetes secret `neuvector-store-secret` in `neuvector` namespace to dynamically generate cryptographically secure random keys. This approach removes the reliance on static key values and ensures that encryption keys are managed securely within Kubernetes.
During rolling upgrade or restoring from persistent storage, the NeuVector controller checks each encrypted configured field. If a sensitive field in the configuration is found to be encrypted by the default encryption key, it’s decrypted with the default encryption key and then re-encrypted with the new dynamic encryption key.
If the NeuVector controller does not have the correct RBAC for accessing the new secret, it writes this error log : 
`Required Kubernetes RBAC for secrets are not found` and exits.
The device encryption key is rotated every 3 months. For details, please refer to this [Rotating Self-Signed Certificate](https://open-docs.neuvector.com/configuration/console/certrotate) documentation.
### Patches
Patched versions include release **v5.4.7** and above.
### Workarounds
There is no workaround for this issue. Users are recommended to upgrade, as soon as possible, to a version of NeuVector that contains the fix.
### References
If you have any questions or comments about this advisory:
- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).

CVE-2025-54471

GoLang

### Impact
This vulnerability affects NeuVector deployments only when the `Report anonymous cluster data option` is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server at `https://upgrades.neuvector-upgrade-responder.livestock.rancher.io`.
In affected versions, NeuVector does not enforce TLS certificate verification when transmitting anonymous cluster data to the telemetry server. As a result, the communication channel is susceptible to man-in-the-middle (MITM) attacks, where an attacker could intercept or modify the transmitted data. Additionally, NeuVector loads the response of the telemetry server is loaded into memory without size limitation, which makes  it vulnerable to a Denial of Service(DoS) attack. 
The patched version includes the following security improvements:
- NeuVector now verifies the telemetry server’s `TLS certificate chain` and `hostname` during the handshake process. This ensures that all telemetry communications occur over a trusted and verified channel.
- NeuVector limits the telemetry server’s response to `256 bytes`, mitigating the risk of memory exhaustion and DoS attacks.
These security enhancements are enabled by default and require no user action.
### Patches
Patched versions include release **v5.4.7** and above.
### Workarounds
If you cannot update to a patched version, you can temporarily disable the Report anonymous cluster data, which is enabled by default in NeuVector.
To change this setting, go to **Settings** → **Configuration** → **Report anonymous cluster data** in the NeuVector UI.
Disabling this option prevents NeuVector from sending telemetry data to the telemetry server, which helps mitigate this vulnerability.
### References
If you have any questions or comments about this advisory:
- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).

CVE ID	Severidad	Puntuación	Tecnologías	Nombre del componente	Exploit de CISA KEV	Tiene arreglo	Fecha de publicación
CVE-2025-61882	CRITICAL	9.8	Oracle E-Business Suite	cpe:2.3:a:oracle:e-business_suite	Sí	No	Oct 05, 2025
CVE-2025-49844	CRITICAL	9.9	Redis	valkey	No	Sí	Oct 03, 2025
CVE-2025-20362	MEDIUM	6.5	Cisco Adaptive Security Appliance (ASA)	cpe:2.3:a:cisco:firepower_threat_defense	Sí	Sí	Sep 25, 2025
CVE-2025-20333	CRITICAL	9.9	Cisco Adaptive Security Appliance (ASA)	cpe:2.3:a:cisco:firepower_threat_defense	Sí	Sí	Sep 25, 2025
CVE-2025-10035	CRITICAL	9.8	GoAnywhere MFT	cpe:2.3:a:fortra:goanywhere_managed_file_transfer	Sí	Sí	Sep 18, 2025

CVE ID	Severidad	Puntuación	Tecnologías	Nombre del componente	Exploit de CISA KEV	Tiene arreglo	Fecha de publicación
GHSA-fp5x-7m4q-449f	LOW	2	Rust	direct_ring_buffer	No	Sí	Oct 21, 2025
GHSA-h5j3-crg5-8jqm	LOW	2	Rust	orx-pinned-vec	No	Sí	Oct 21, 2025
CVE-2025-62607	MEDIUM	5.3	Python	nautobot-ssot	No	Sí	Oct 21, 2025
CVE-2025-54471	MEDIUM	6.5	N/A	github.com/neuvector/neuvector	No	Sí	Oct 21, 2025
CVE-2025-54470	HIGH	8.6	N/A	https://github.com/neuvector/neuvector	No	Sí	Oct 21, 2025

Base de datos de vulnerabilidades de Wiz

Explorar por tecnología

Filtros populares

Alto perfil

Último

Vulnerabilidades en cifras

Lo bueno, lo malo y lo vulnerable

Recursos adicionales de Wiz

¿Listo para ver a Wiz en acción?