SUSE SLED15 / SLES15 / openSUSE 15 Security Update : fontforge (SUSE-SU-2024:0864-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0864-1 advisory. - CVE-2024-25081: Fixed command injection via crafted filenames bsc1220404. - CVE-2024-25082:...

SUSE-SU-2024:0864-1 Security update for fontforge

This update for fontforge fixes the following issues: - CVE-2024-25081: Fixed command injection via crafted filenames bsc1220404. - CVE-2024-25082: Fixed command injection via crafted archives or compressed files bsc1220405...

SUSE-SU-2024:0863-1 Security update for fontforge

This update for fontforge fixes the following issues: - CVE-2024-25081: Fixed command injection via crafted filenames bsc1220404. - CVE-2024-25082: Fixed command injection via crafted archives or compressed files bsc1220405...

CVE-2024-25082

creationtimestamp| type| source ---|---|--- 2024-02-26 23:06:49+00:00| seen| https://t.me/ctinow/193818 2024-03-14 08:52:05+00:00| seen| https://t.me/ctinow/207549 2026-04-09 09:00:11+00:00| published-proof-of-concept| Telegram/FTDdCpTyVgn18WJWm8sxTIwHPAzeX7K6MUC864Tispt-Q74 2026-04-12...

CVE-2024-25082

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files...

CVE-2024-25082

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files...

CVE-2024-25082

FontForge (through 20230101) is affected by CVE-2024-25081 and CVE-2024-25082, allowing shell command injection via specially crafted filenames or archives/compressed files. Public advisories from Debian (DSA-5641-1), AlmaLinux (ALSA-2024-2495 / ALSA-2024-565), and Amazon Linux (ALAS2024-2495 / A...

CVE-2024-25082

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files...

CVE-2019-25082

Rejected reason: This candidate is unused by its CNA...

CVE-2023-25082

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2023-25082

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

CVE-2018-25082

creationtimestamp| type| source ---|---|--- 2023-03-21 21:35:00+00:00| seen| https://t.me/cibsecurity/60400...

CVE-2018-25082 zwczou WeChat SDK Python to_xml xml external entity reference

A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/toxml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patc...

TOTOLink A860R Command Injection (CVE-2022-25076; CVE-2022-25078; CVE-2022-25079; CVE-2022-25080; CVE-2022-25081; CVE-2022-25082; CVE-2022-25083; CVE-2022-25084)

A command injection vulnerability exists in TOTOLink A860R. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

WordPress Popup Builder Plugin < 4.0.7 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sygnoos:popupbuilder"; if description...

CVE-2022-25082

creationtimestamp| type| source ---|---|--- 2022-02-24 18:14:54+00:00| seen| https://t.me/cibsecurity/38000...

CVE-2022-25082

TOTOLink A950RG V5.9c.4050B20190424 and V4.1.2cu.5204B20210112 were discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERYSTRING parameter...

CVE-2022-25082

Totolink A950RG firmware versions V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 contain a command-injection vulnerability in the Main function, allowing arbitrary commands via the QUERY_STRING parameter. Impact can be high: network-based, unauthenticated, with high confidentiality, integrity, ...

CVE-2022-25082

TOTOLink A950RG V5.9c.4050B20190424 and V4.1.2cu.5204B20210112 were discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERYSTRING parameter...

CVE-2021-25082

The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpbtype parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via...