SUSE多款产品 安全漏洞

SUSE Manager and SUSE Manager Server are both products of SUSE Germany.SUSE Manager is a Linux server management system. The system provides automated software management, system configuration, and monitoring.SUSE Manager Server is an infrastructure management solution designed to simplify and...

SUSE多款产品 安全漏洞

SUSE Manager and SUSE Manager Server are both products of SUSE Germany.SUSE Manager is a Linux server management system. The system provides automated software management, system configuration, and monitoring.SUSE Manager Server is an infrastructure management solution designed to simplify and...

SUSE SLES15: python3-rhnlib / spacewalk-backend / spacewalk-backend-app / etc (SUSE-SU-2025:3826-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3826-1 advisory. susemanager-build-keys: - Update SUSE GPG key and make it available for Salt bsc1250911 susemanager-sls: - Version 4.3.50-0 Fix OS Family grain...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the endpoint parameter in Headless API. An attacker can perform unauthorized actions by tricking a user into making unintended requests. Remediation A fix was pushed into the master branch but not yet...

Division by zero

Overview Affected versions of this package are vulnerable to Division by zero via the CLAHEImage function in MagickCore/enhance.c. An attacker can cause the process to crash or exhaust system resources by supplying crafted parameters or very small images that result in zero tile dimensions, leadi...

CVE-2025-62169

OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks...

EUVD-2025-35702

OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks...

CVE-2025-62169 OctoPrint-SpoolManager Plugin APIs do not enforce authentication

OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks...

Predictable Seed in Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Predictable Seed in Pseudo-Random Number Generator PRNG via the use of RandomStringUtils with the default java.util.Random PRNG. An attacker can recover sensitive information by predicting the server-side encryption key if they can obta...

Predictable Seed in Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Predictable Seed in Pseudo-Random Number Generator PRNG via the use of RandomStringUtils with the default java.util.Random PRNG. An attacker can recover sensitive information by predicting the server-side encryption key if they can obta...

CVE-2025-62696

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard Extension allows Command Injection.This issue affects Mediawiki Foundation - Springboard Extension: master...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the String.equals checks. An attacker can cause unauthorized modification of data by exploiting improper validation or manipulation of string data. Remediation A fix was pushed into the master branch but not...

CVE-2025-62698

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuidance allows Stored XSS.This issue affects Mediawiki - ExternalGuidance: from master before 1.39...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via discrepancies in processing invalid padding errors in legacy API mbedtlsciphercrypt and mbedtlscipherfinish functions and in the PSA Crypto API psacipherdecrypt and psacipherfinish functions when handling any other...

Malicious Package

Overview webpack-css-load-branch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious code in webpack-css-load-branch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebc3a0cfad4acfa46f4ea9e57edb732f20403908d855eca202b5ad08df232468 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-35143

Malicious code in webpack-css-load-branch npm...

MAL-2025-48538 Malicious code in webpack-css-load-branch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebc3a0cfad4acfa46f4ea9e57edb732f20403908d855eca202b5ad08df232468 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2025-62702

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - PageTriage Extension: from master before 1.44...

CVE-2025-62696

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard Extension allows Command Injection.This issue affects Mediawiki Foundation - Springboard Extension: master...