Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k – added a range check for connrspepid in htcconnectservice. I have also identified the following bugs in my fuzzer: - UBSAN: Array index out of bounds in drivers/net/wireless/ath/ath9k/htchst.c:26:51. Index 255 is out...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hciconn: A null pointer dereferencing occurred in hciabortconn. hciabortconn attempts to read hciskbeventhdev-sentcmd when a connection is pending. However, hdev-sentcmd can be NULL while reqstatus remains HCIREQPEN...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: fixed a memory leak in tcpconnrequest. If inetcskreqskqueuehashadd returns false, tcpconnrequest will return without freeing the dst memory, which was allocated in afops-routereq. Here is the stack trace for the issue:...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remapping EPERM in case of connection failure in xstcpsetupsocket. When using a BPF program on kernelconnect, the call may return -EPERM. This causes xstcpsetupsocket to loop indefinitely, filling up the syslog and...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: CT: Fixed the null-ptr-deref in addruleerrflow In the error flow of mlx5tcctentryaddrule, if the ctruleadd callback returns an error, zonerule-attr is used without initialization. This issue was fixed by using attr,...

BIT-NODE-2025-23085

A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory...

SUSE CVE-2025-24787

WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The application uses string concatenation to build...

PT-2025-6302 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a denial-of-service vulnerability in the Internet Connection Sharing ICS function of Windows operating systems. It involves reading beyond the valid range in memory...

PT-2025-6218 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.12.2 Description: The issue is related to improper Kubernetes connection settings, which could expose sensitive resources. Recommendations: For versions prior to 2024.12.2, update to version 2024.12.2...

PT-2025-6310 · Microsoft · Internet Connection Sharing +1

Name of the Vulnerable Software and Affected Versions: Internet Connection Sharing ICS affected versions not specified Description: The issue is related to an uncontrolled consumption of resources in the Internet Connection Sharing ICS function of Windows operating systems. This can be exploited ...

Intel®  Ethernet Connection I219 Series Software Advisory

Summary: Potential security vulnerabilities in Intel® Ethernet Connection I219 Series may allow denial of service. Intel is releasing updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2024-39797 Description: Improper access control in some drivers for Intel®...

The vulnerability of the application and service integration tool based on the Matrix protocol, Matrix Hookshot, arises from insufficient checking of unusual or exceptional states, allowing a hacker to trigger a service failure.

The vulnerability of the application and service integration tool based on the Matrix Protocol, Matrix Hookshot, is related to insufficient checking of unusual or exceptional states during connection to the GitHub platform. Exploiting this vulnerability can allow a remote attacker to cause servic...

waitress: Waitress has a denial of service leading to high CPU usage/resource exhaustion

A flaw was found in the Waitress WSGI server for Python. When a remote client closes the connection before waitress has had the opportunity to call getpeername, waitress will incorrectly clean up the connection, leading to the main thread attempting to write to a socket that no longer exists, and...

Azure Linux 3.0 Security Update: kernel (CVE-2024-42246)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42246 advisory. - In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of...

Azure Linux 3.0 Security Update: cmake / curl / mysql / rust / tensorflow (CVE-2023-27536)

The version of cmake / curl / mysql / rust / tensorflow installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-27536 advisory. - An authentication bypass vulnerability exists libcurl 8.0.0 in the...

Azure Linux 3.0 Security Update: kernel (CVE-2024-46795)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46795 advisory. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset the binding mark of a reuse...

MGASA-2025-0046 Updated qtbase5 & qtbase6 packages fix security vulnerabilities

network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check. CVE-2023-51714 A buffer overflow and application crash can occur via a crafted KTX image file. CVE-2024-25580 Code to make security-relevant decisions about an established connection may execute too early, because...

VDA launch failure via Workspace and browser with error "VDA refused connection"

While launching the applications after successful gateway authentication from the browser and Citrix workspace app. users get error "Gateway authentication failed because VDA refused connection "...

CVE-2025-23415

An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN connection initiated thru BIG-IP APM browser network access VPN client for Windows, macOS and Linux. Note:...

GO-2025-3457 WhoDB allows parameter injection in DB connection URIs leading to local file inclusion in github.com/clidey/whodb/core

WhoDB allows parameter injection in DB connection URIs leading to local file inclusion in github.com/clidey/whodb/core...