MAL-2025-1567 Malicious code in morganstanley.github.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da18628bae17a4b84b5818efb61d96bb37f0cddacea85240fbf4856ff0340353 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-25461

A Stored Cross-Site Scripting XSS vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server an...

CVE-2025-25461

CVE-2025-25461 affects SeedDMS 6.0.29. A stored XSS flaw exists in the category-name field: a user with Add Category permission can inject payloads that are stored server-side and rendered unencoded when a document is viewed, allowing execution in other users’ browsers. The root cause is lack of ...

The vulnerability of the sctp_association_init() function in the Linux operating system’s kernel allows a hacker to execute arbitrary code.

The vulnerability of the sctpassociationinit function in the Linux operating system’s kernel is related to integer overflow. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

kernel: xfrm: validate new SA's prefixlen using SA family when sel.family is unset

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a "xfrm: Validate address prefix lengths in the xfrm selector." syzbot created an SA with...

CVE-2022-37660

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sctp: The issue of integer overflow during autoclose operations in sctpassociationinit has been addressed. By default, maxautoclose equals INTMAX / HZ. However, it is possible to set net.sctp.maxautoclose to UINTMAX. There is...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: Validates the prefix length of new SA entries using the SA family, when sel.family is unset. This extends the validation introduced in commit 07bf7908950a “xfrm: Validates address prefix lengths in the xfrm selector”. The...

hostapd 安全漏洞

hostapd is a user space daemon for access points and authentication servers by the individual developer Jouni Malinen. A security vulnerability exists in hostapd version 2.10 and earlier, which stems from the PKEX code remaining active after successful association, making it vulnerable to attack...

CVE-2022-37660

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the...

CVE-2022-37660

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the...

PT-2025-6404

Name of the Vulnerable Software and Affected Versions: hostapd versions 2.10 and earlier Description: The issue concerns the PKEX code remaining active even after a successful PKEX association. An attacker who has successfully bootstrapped public keys with another entity using PKEX in the past ca...

CVE-2022-37660

CVE-2022-37660 affects hostapd up to version 2.10, where the PKEX code remains active after a successful PKEX association. An attacker who has bootstrapped public keys with another entity in the past can subvert a future bootstrapping by passively observing public keys and manipulating the encryp...

Teen on Musk’s DOGE Team Graduated from ‘The Com’

Wired reported this week that a 19-year-old working for Elon Musk 's so-called Department of Government Efficiency DOGE was given access to sensitive US government systems even though his past association with cybercrime communities should have precluded him from gaining the necessary security...

AZL-56399 CVE-2025-21674 affecting package kernel for versions less than 6.6.76.1-1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel Attempt to enable IPsec packet offload in tunnel mode in debug kernel generates the following kernel panic, which is happening due to two issues: 1. In SA ad...

CVE-2025-21674 net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel Attempt to enable IPsec packet offload in tunnel mode in debug kernel generates the following kernel panic, which is happening due to two issues: 1. In SA ad...

SUSE CVE-2024-57938

In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctpassociationinit While by default maxautoclose equals to INTMAX / HZ, one may set net.sctp.maxautoclose to UINTMAX. There is code in sctpassociationinit that can consequently...

AZL-55916 CVE-2024-57938 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctpassociationinit While by default maxautoclose equals to INTMAX / HZ, one may set net.sctp.maxautoclose to UINTMAX. There is code in sctpassociationinit that can consequently...

DEBIAN-CVE-2024-57938

In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctpassociationinit While by default maxautoclose equals to INTMAX / HZ, one may set net.sctp.maxautoclose to UINTMAX. There is code in sctpassociationinit that can consequently...

AZL-55901 CVE-2024-57938 affecting package kernel for versions less than 6.6.76.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctpassociationinit While by default maxautoclose equals to INTMAX / HZ, one may set net.sctp.maxautoclose to UINTMAX. There is code in sctpassociationinit that can consequently...