CVE-2025-6018 Pam-config: lpe from unprivileged to allow_active in pam

A Local Privilege Escalation LPE vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules PAM. This flaw allows an unprivileged local attacker for example, a user logged in via SSH to obtain the elevated privileges normally reserved for a physically present,...

CVE-2025-6018

A Local Privilege Escalation LPE vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules PAM. This flaw allows an unprivileged local attacker for example, a user logged in via SSH to obtain the elevated privileges normally reserved for a physically present,...

CVE-2025-6235

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

SUSE-SU-2025:02475-1 Security update 4.3.16 for Multi-Linux Manager Server

This update fixes the following issues: cobbler: - Prevent crash during Cobbler startup on NFS environments bsc1240666 - Synchronize cobbler add and sync actions bsc1233371 - Exclude disabled profiles from buildiso gen bsc1230908 grafana-formula: - Version 4.3.0: Added SUSE Linux Enterprise Serve...

WordPress WP Post Hide Cross-Site Request Forgery Vulnerability

WordPress WP Post Hide is a plugin for controlling the visibility of WordPress posts, hiding the display of specific posts in different locations such as the home page, category pages, and search results pages. WordPress WP Post Hide suffers from a cross-site request forgery vulnerability, which...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with WebSphere Remote Server, are affected by a security bypass vulnerability (CVE-2024-56339)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are shipped with IBM WebSphere Remote Server. Information about a security vulnerability affecting IBM WebSphere Application Server and WebSphere Application Server Liberty has been published in a security bulletin...

“Encryption Backdoors and the Fourth Amendment”

Law journal article that looks at the DualECPRNG backdoor from a US constitutional perspective: Abstract : The National Security Agency NSA reportedly paid and pressured technology companies to trick their customers into using vulnerable encryption products. This Article examines whether any of...

HAX CMS application pages vulnerable to clickjacking

Summary All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites. PoC To replicate this vulnerability, load the target page in an iframe and observe the rendered content. Impact ...

CVE-2025-6235

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

CVE-2025-6235 ExtremeControl (NAC) 'onmouseover' XSS

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

CVE-2025-6235

CVE-2025-6235 affects ExtremeControl prior to 25.5.12, with an XSS in the login interface due to improper handling of user input in HTML attributes. The vulnerability can allow injected script to run in a user’s browser under certain interactions, potentially exposing user data or enabling unauth...

PT-2025-31594 · Github Actions · Buildalon/Setup-Steamcmd

Summary Log output includes authentication token that provides full account access Details The post job action prints the contents of config/config.vdf which holds the saved authentication token and can be used to sign in on another machine. This means any public use of this action leaves...

PT-2025-31593 · Github Actions · Rageagainstthepixel/Setup-Steamcmd

Summary Log output includes authentication token that provides full account access Details The post job action prints the contents of config/config.vdf which holds the saved authentication token and can be used to sign in on another machine. This means any public use of this action leaves...

MAL-2025-191746 Malicious code in hahabott (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 89ed03d9e80d4ef62c54087a12177f795e478b1b5e5a8af69ef4e4740e102186 If run as module, it attempts to automatically destroy user's and system's files. Some versions also exfiltrate them. --- Category: MALICIOUS - The campaign ha...

CVE-2025-6983

A Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into performing unintended actions via rendered UI layers or frames.This issue affects Archer C1200 = 1.1.5...

PT-2025-30088 · Ibm · Ibm Sterling File Gateway +1

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.0.0.0 through 6.1.2.7 IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.4 Description: The software uses a web link with untrusted...

CVE-2025-6983

CVE-2025-6983 affects TP-Link Archer C1200 web management, with a clickjacking flaw in versions 1.1.5 and earlier. An attacker could trick a logged-in user into performing unintended actions via layered UI/frames. No exploitation details are provided in the initial and connected documents, but mu...

How to catch GitHub Actions workflow injections before attackers do

You already know that security is important to keep in mind when creating code and maintaining projects. Odds are, you also know that it's much easier to think about security from the ground up rather than trying to squeeze it in at the end of a project. But did you know that GitHub Actions...

TP-LINK Archer C1200 安全漏洞

TP-LINK Archer C1200 is a wireless router from China P&L TP-LINK. A security vulnerability exists in TP-LINK Archer C1200 version 1.1.5 and earlier, which stems from a clickjacking risk that could cause users to perform unintended actions...

PT-2025-29751 · WordPress · Relywp Coupon Affiliates

Name of the Vulnerable Software and Affected Versions: RelyWP Coupon Affiliates versions through 6.4.0 Description: The software contains a Cross-Site Request Forgery CSRF flaw. This issue allows attackers to perform actions on behalf of authenticated users without their knowledge. Recommendation...