Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: undici: Undici Uses Insufficiently Random Values CVE-2025-22150 nodejs: Node.js Worker Thread Exposure via Diagnostics Channel CVE-2025-23083...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a contention condition that can be caused if a device is logged off while the number of device channels is...

Zulip 信息泄露漏洞

Zulip is a powerful open source group chat application from Zulip, Inc. It is used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. Zulip suffers from an information disclosure vulnerability that stems from not properly limiting the scope of...

PT-2025-7053 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip affected versions not specified Description: A weekly cron job in Zulip demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization,...

PT-2025-6829 · Schneider Electric · Asco 5310 Single-Channel Remote Annunciator

Name of the Vulnerable Software and Affected Versions: Schneider Electric - ASCO 5310 Single-Channel Remote Annunciator versions all Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which could render the device inoperable when a malicious file is downloade...

CVE-2025-25195: Exposure of Sensitive Information to an Unauthorized Actor

Zulip is an open source team chat application. A weekly cron job added in 50256f48314250978f521ef439cafa704e056539 demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in...

CVE-2024-39271

CVE-2024-39271 affects Intel PROSet/Wireless WiFi and Killer WiFi software prior to version 23.80. The root cause is improper restriction of the communication channel to intended endpoints, which could allow an unauthenticated adjacent user to disclose information. Multiple sources (Intel advisor...

nodejs: Node.js Worker Thread Exposure via Diagnostics Channel

A flaw was found in the Node.js diagnosticschannel. This vulnerability allows an attacker to reinstate and misuse worker constructors, potentially bypassing the Permission Model via hooking into events when a worker thread is created...

SUSE SLES12 Security Update : openssl-1_1 (SUSE-SU-2025:0390-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:0390-1 advisory. - CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation bsc1236136 Tenable has extracted the preceding description block directl...

Intel PROSet/Wireless WiFi和Intel Killer WiFi 安全漏洞

Intel PROSet/Wireless WiFi and Intel Killer WiFi are both wireless network card drivers from Intel Corporation USA. A security vulnerability exists in Intel PROSet/Wireless WiFi and Intel Killer WiFi prior to version 23.80, which arises from improper restriction of the communication channel to th...

Ubuntu 24.10 : OpenSSL vulnerabilities (USN-7264-1)

The remote Ubuntu 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7264-1 advisory. It was discovered that OpenSSL clients incorrectly handled authenticating servers using RFC7250 Raw Public Keys. In certain cases, the connection will not...

USN-7264-1: OpenSSL vulnerabilities

It was discovered that OpenSSL clients incorrectly handled authenticating servers using RFC7250 Raw Public Keys. In certain cases, the connection will not abort as expected, possibly causing the communication to be intercepted. CVE-2024-12797 George Pantelakis and Alicja Kario discovered that...

Security update for openssl-3

This update for openssl-3 fixes the following issues: CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation bsc1236136. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can...

SUSE-SU-2025:0430-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation bsc1236136...

CVE-2023-37482

The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames...

CVE-2023-37482

CVE-2023-37482 affects Siemens SIMATIC web servers (e.g., SIMATIC S7-1200/1500 family). The vulnerability stems from login response timing not being normalized, enabling an unauthenticated remote attacker to perform user enumeration by distinguishing valid vs. invalid usernames via a side channel...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Firmware: armscmi: Fixed a double-free operation in the OPTEE transport. Channels can be shared between protocols; avoiding the need to free the same descriptor twice when unloading the stack...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: lpfc: Moved the unregistration of NPIV’s transport to after resource cleanup. There are cases after NPIV is deleted where the fabric switch still believes that NPIV is registered with the fabric. This occurs when a vport...

Astra Linux – Vulnerability in gst-plugins-base1.0

GStreamer is a library for constructing graphs of media-handling components. A OOB-read vulnerability has been detected in the formatchannelmask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed size of 64 elements. However, the functi...

Astra Linux – Vulnerability in gnutls28

A flaw was discovered in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behaviors in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLSPRIVKEYFLAGREPRODUCIBLE flag, it can result in a noticeable reducti...