Oracle E-Business Suite (EBS) is a comprehensive suite of integrated business applications that enable organizations to make better decisions, reduce costs, and increase performance. It covers a wide range of business functions, including financials, supply chain management, human resources, customer relationship management, procurement, project management, and more.

Oracle E-Business Suite

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2025-61882

Linux

Linux Kernel

Redis is a data structure server. It is open-source, networked, in-memory, and stores keys with optional durability.

Redis

Valkey is a high-performance, open-source, in-memory data store used as a database, cache, and message broker. It is a community-driven fork of Redis, created in 2024 after Redis changed its license to a more restrictive model. Valkey retains full Redis compatibility and remains under the permissive BSD license, ensuring it's free and open-source for all use cases.

Valkey

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Linux Debian

Ubuntu is a Linux distribution based on Debian, mostly composed of free and open-source software. Ubuntu is officially released in three editions: Desktop, Server, and Core for internet of things devices and robots. All the editions can run on the computer alone or in a virtual machine.

Linux Ubuntu

Fedora is a popular open-source, Linux-based operating system.

Linux Fedora

Red Hat Enterprise Linux is a Linux distribution developed by Red Hat for the commercial market.

Linux Red Hat

Linux openSUSE

The Amazon Linux is a supported and maintained Linux image provided by Amazon Web Services for use on Amazon Elastic Compute Cloud (Amazon EC2).

Amazon Linux

Alpine Linux is a Linux distribution based on musl and BusyBox, designed for security, simplicity, and resource efficiency.

Linux Alpine

Oracle Linux is a Linux distribution packaged and freely distributed by Oracle, available partially under the GNU General Public License since late 2006. It is compiled from Red Hat Enterprise Linux source code, replacing Red Hat branding with Oracle's.

Linux Oracle

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

CVE-2025-49844

Alpine

Alpine Security Tracker

CBL-Mariner

CBL Mariner

Debian

Debian Security Tracker

Homebrew

MinimOS

Minimus

NixOS

Red Hat

Red Hat Errata

Rocky

Rocky Linux

Rocky Linux Product Errata

Ubuntu

Ubuntu Security Tracker

Cisco Adaptive Security Appliance (ASA) is a security device that combines firewall, antivirus, intrusion prevention, and virtual private network (VPN) capabilities. It provides proactive threat defense that stops attacks before they spread through the network.

Cisco Adaptive Security Appliance (ASA)

Cisco Firepower Threat Defense (FTD) is a unified software solution that integrates comprehensive network security features, including firewall capabilities, application control, intrusion prevention, and malware protection.

Cisco Firepower Threat Defense (FTD)

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication.
 This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

CVE-2025-20362

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
 This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

CVE-2025-20333

GoAnywhere MFT is a secure managed file transfer (MFT) software solution that allows businesses to securely exchange files with trading partners, customers, and internal systems.

GoAnywhere MFT

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

CVE-2025-10035

Windows

Windows Cumulative Update

WordPress is a content management system paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

WordPress

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions up to, and including, 1.3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2025-11735

The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via the upload_to_library function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieval.

CVE-2025-10145

Liferay Portal is an open-source enterprise portal framework.

Liferay Portal

Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.

CVE-2025-62259

VulnCheck NVD++

CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.

CVE-2025-62258

Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.

CVE ID	Severità	Punteggio	Tecnologie	Nome del componente	Exploit CISA KEV	Ha la correzione	Data di pubblicazione
CVE-2025-61882	CRITICAL	9.8	Oracle E-Business Suite	cpe:2.3:a:oracle:e-business_suite	Sì	No	Oct 05, 2025
CVE-2025-49844	CRITICAL	9.9	Redis	redis6-debuginfo	No	Sì	Oct 03, 2025
CVE-2025-20362	MEDIUM	6.5	Cisco Adaptive Security Appliance (ASA)	cpe:2.3:a:cisco:firepower_threat_defense	Sì	Sì	Sep 25, 2025
CVE-2025-20333	CRITICAL	9.9	Cisco Adaptive Security Appliance (ASA)	cpe:2.3:a:cisco:firepower_threat_defense	Sì	Sì	Sep 25, 2025
CVE-2025-10035	CRITICAL	9.8	GoAnywhere MFT	cpe:2.3:a:fortra:goanywhere_managed_file_transfer	Sì	Sì	Sep 18, 2025

CVE ID	Severità	Punteggio	Tecnologie	Nome del componente	Exploit CISA KEV	Ha la correzione	Data di pubblicazione
CVE-2025-11735	HIGH	7.5	WordPress	woocommerce-products-filter	No	Sì	Oct 28, 2025
CVE-2025-10145	HIGH	7.7	WordPress	auto-post-thumbnail	No	Sì	Oct 28, 2025
CVE-2025-62259	MEDIUM	6.9	Liferay Portal	cpe:2.3:a:liferay:liferay_portal	No	Sì	Oct 27, 2025
CVE-2025-62258	HIGH	7	Liferay Portal	cpe:2.3:a:liferay:liferay_portal	No	Sì	Oct 27, 2025
CVE-2025-62261	MEDIUM	6.9	Liferay Portal	cpe:2.3:a:liferay:liferay_portal	No	Sì	Oct 27, 2025

Database delle vulnerabilità Wiz

Esplora per tecnologia

Filtri popolari

Alto profilo

Più recenti

I numeri delle vulnerabilità

Il buono, il cattivo e il vulnerabile

Ulteriori risorse Wiz

PEACH

Pronti a vedere Wiz in azione?