ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling

A flaw was found in Artifex Ghostscript's PDF XRef stream handling. This vulnerability allows a buffer overflow via crafted values in the W array of a PDF XRef stream...

kernel: mm: call the security_mmap_file() LSM hook in remap_file_pages()

A flaw was found in the remapfilepages function in mm/mmap.c in the Linux kernel, where it does not properly restrict execute access. This vulnerability allows local users to bypass intended SELinux W^X policy restrictions...

Fine-Grained Manipulation Attacks to Local Differential Privacy Protocols for Data Streams

Local Differential Privacy LDP enables massive data collection and analysis while protecting end users' privacy against untrusted aggregators. It has been applied to various data types e.g., categorical, numerical, and graph data and application settings e.g., static and streaming. Recent finding...

CVE-2025-43964

In LibRaw before 0.21.4, tag 0x412 processing in phaseonecorrect in decoders/loadmfbacks.cpp does not enforce minimum w0 and w1 values...

AZL-61756 CVE-2025-43964 affecting package LibRaw 0.21.3-1

In LibRaw before 0.21.4, tag 0x412 processing in phaseonecorrect in decoders/loadmfbacks.cpp does not enforce minimum w0 and w1 values...

AZL-61780 CVE-2025-43962 affecting package LibRaw 0.21.3-1

In LibRaw before 0.21.4, phaseonecorrect in decoders/loadmfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations...

CVE-2025-32809

W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choicefb, or questionid...

CVE-2025-32809

W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choicefb, or questionid...

CVE-2025-32808: Client-Side Enforcement of Server-Side Security

W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side access control exists...

CVE-2025-32808

W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side access control exists...

CVE-2025-32808

Affected software: W. W. Norton InQuizitive (through 2025-04-08). The vulnerability arises from client-side access control, allowing a student to insert arbitrary quiz records into the backend, with integrity impact (I=HIGH) and no confidentiality impact (C=NONE). CVSS details: CVSS 3.1 base scor...

CVE-2025-32809

W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choicefb, or questionid...

CVE-2025-32809: Improper Neutralization of Input During Web Page Generation

W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choicefb, or questionid...

CVE-2025-32808

W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side access control exists...

PT-2025-16018

Name of the Vulnerable Software and Affected Versions: W. W. Norton InQuizitive through 2025-04-08 Description: The issue allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choice fb, or question id. This enables malicious activities by exploiting...

CVE-2025-32809

InQuizitive (W. W. Norton) is affected by CVE-2025-32809 through 2025-04-08, which allows stored cross-site scripting via user-supplied data in bonus description, feedback.choice_fb[], or question_id. The issue is described across multiple sources as a stored XSS vulnerability; exploitation appea...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read due to the stbhwbuildtilesetfromimage function. An attacker can read memory locations that should be inaccessible by manipulating the w argument. Remediation There is no fixed version for stb. References - GitHub Issu...

Linux Distros Unpatched Vulnerability : CVE-2024-47745

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm: call the securitymmapfile LSM hook in remapfilepages The remapfilepages syscall handler calls dommap directly, which doesn't contain the LSM security check...

CVE-2022-0401

Path Traversal in NPM w-zip prior to 1.0.12...

PT-2025-62792

Уязвимость функции w expression match системы обнаружения и предотвращения вторжений Wazuh связана с разыменованием указателей. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации...