Security advice, made clearer

A published advisory describes an authorisation-bypass issue in OpenStation, a WordPress plugin that provides desktop-style windows, a dock and virtual desktops for the admin area.

NIST reports a medium-severity stored cross-site scripting issue in FV Flowplayer Video Player. It affects versions up to and including 7.5.55.7212, under specific settings and approval conditions.

A reported issue in FV Flowplayer Video Player could allow scripts to be stored through comments when a particular plugin setting is enabled. Here is what that means and what to do next.

A high-severity vulnerability has been reported in the Ak Framework plugin, which is included with the Newsy - Viral News & Magazine WordPress Theme. Here is what to check and what to do next.

A medium-severity issue in JS Help Desk – AI-Powered Support & Ticketing System affects versions up to and including 5.0.1. Here is what to check and how to respond sensibly.

A serious weakness in some MariaDB server releases concerns the way a special table-name prefix is handled. Here is how to check your installation and decide what to do.

A flaw in MariaDB server can mishandle a password-related permission check. The affected releases are shown in the accompanying table; this is guidance for checking, not evidence that any particular site has been compromised.

A published security advisory describes a medium-severity weakness in MariaDB’s CONNECT engine file-access functions. It may allow a low-privileged database user to read or write files beyond the intended database permissions.

A medium-severity MariaDB server vulnerability can expose memory when specially malformed spatial data is processed. Check the affected-versions table and follow MariaDB’s confirmed update guidance.

A critical vulnerability affects certain MariaDB server releases. Here is what site owners and administrators should check, without assuming that an affected release means a compromise.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A published advisory describes a medium-severity denial-of-service issue in certain versions of svg-sanitizer. Here is what site owners should check and do next.

A high-severity vulnerability in svg-sanitizer could make a website’s PHP workers spend excessive time processing a specially prepared SVG file. Here is what to check and what the available evidence does—and does not—show.

A security issue in older versions of the open-source pypdf library could make an application use excessive memory when opening a specially crafted PDF. Here is how to check whether it is relevant to your site or software.

A high-severity issue in pypdf can cause excessive processing and memory use when an application reads the page count of a specially crafted encrypted PDF.

A flaw in the Python PDF library pypdf can cause excessive memory use when it processes a specially malformed PDF. Here is how to check what your site or application uses.

A high-severity issue in OAuthLib can affect applications using a particular device-authorisation workflow. Here is what the published evidence means and what to do next.

A high-severity security issue affects certain GraphQL Tools releases when untrusted incremental GraphQL responses are processed. Here is what it means and what to do next.

A reported issue in Pillow can use unusually large amounts of processor time and temporary storage when certain untrusted image files are processed. Here is how to assess it calmly.

A high-severity security issue in Pillow can affect applications that process specially prepared TIFF images. Here is what to check, without assuming that any particular website has been compromised.

A reported security flaw in OpenEMR could leave patient documents temporarily exposed through a predictable public file address. Affected releases are listed in the accompanying table.