Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the use of WARNON by hfs/hfsplus for integrity checking and should be changed to proper error handling...

CVE-2018-25135: Improper Neutralization of Quoting Syntax

Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing...

SQL Injection

Overview Kentico.Xperience.Libraries is a package for libraries and applications that use Kentico Xperience API. Affected versions of this package are vulnerable to SQL Injection via the whereCondition parameter of the DidActivity macro method in the ContactInfoMethods class. An authenticated...

CVE-2021-47711

A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses...

CVE-2021-47711

A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses...

PT-2025-52300

Name of the Vulnerable Software and Affected Versions Kentico Xperience affected versions not specified Description A SQL injection issue exists in Kentico Xperience, potentially allowing authenticated editors to inject malicious SQL queries through online marketing macro method parameters. This ...

PT-2025-52298

Name of the Vulnerable Software and Affected Versions Kentico Xperience affected versions not specified Description An access control bypass allows administrators to modify global administrator user privileges through unauthorized requests. This could lead to the compromise of global administrato...

CVE-2020-36890: Missing Authorization

An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege...

Kentico Xperience SQL注入漏洞

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the Online Marketing Macro Method parameter. An attacker can exploit this vulnerability to...

CVE-2021-47711: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991118)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991118 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add the missing IPSETHASHWITHNET0 macro for ipsethashnetportnet.c The missing...

XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

GHSA-9XC6-C2RM-F27P XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

SUSE CVE-2023-53746

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix memory leak in vfioap device driver The device release callback function invoked to release the matrix device uses the devgetdrvdatadevice dev function to retrieve the pointer to the vfiomatrixdev object in orde...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: emacs (UTSA-2025-991095)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991095 advisory. In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point for code completion on untrusted Emacs Lisp source code can trigger...

EUVD-2023-60086

In the Linux kernel, the following vulnerability has been resolved: kcsan: Avoid READONCE in readinstrumentedmemory Haibo Li reported: | Unable to handle kernel paging request at virtual address | ffffff802a0d8d7171 | Mem abort info:o: | ESR = 0x9600002121 | EC = 0x25: DABT current EL, IL = 32...

DEBIAN-CVE-2023-53746

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix memory leak in vfioap device driver The device release callback function invoked to release the matrix device uses the devgetdrvdatadevice dev function to retrieve the pointer to the vfiomatrixdev object in orde...

CVE-2023-53746

CVE-2023-53746 relates to a memory leak in the s390/vfio-ap device driver of the Linux kernel. The release path freed the vfio_matrix_dev memory by calling kfree, but the object is not stored as drvdata for the device; the code then relies on null pointer handling, causing the vfio_matrix_dev mem...

CVE-2025-65036

XWiki Remote Macros (xwiki-pro-macros) prior to version 1.27.1 allow remote code execution by executing Velocity from details pages without proper permission checks. Affected component is the macro rendering feature used for Confluence content migration. The issue is fixed in 1.27.1; remediation ...

CVE-2025-65036 XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1...