TencentOS Server 4: python-pycares (TSSA-2025:0971)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0971 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

FreeBSD 安全漏洞

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A security vulnerability exists in FreeBSD that stems from a DNSSL domain name that rtsold8 does not validate shell metacharacters before passing them to resolvconf8, which could lead to remote code execution from a...

Avahi Service Detection Randomness Data Compromise

The vulnerability of the Avahi service detection system in local networks is related to the use of insufficiently random values. Exploiting this vulnerability allows a malicious actor to influence the confidentiality of protected information by using specially crafted DNS requests, while using a...

SUSE CVE-2025-68295

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix memory leak in cifsconstructtcon When having a multiuser mount with domain= specified and using cifscreds, cifssetcifscreds will end up setting @ctx-domainname, so it needs to be freed before leaving...

resolv: Denial of Service in resolv gem

A denial of service flaw was found in resolv ruby gem. This flaw allows an attacker to craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses this packet, the name decompression process consumes a large amount of CPU resources, as the library does...

RLSA-2023:2764 Moderate: python39:3.9 and python39-devel:3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following...

CVE-2025-59029

A flaw was found in PowerDNS. This vulnerability allows an attacker to trigger an assertion failure via requesting crafted DNS Domain Name System records, waiting for them to be inserted into the records cache, then sending a query with qtype set to ANY. Mitigation To mitigate this issue, restric...

CVE-2025-29231

A stored cross-site scripting XSS vulnerability in the pagesave component of Linksys E5600 V1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hostname and domainName parameters...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

Unity Linux 20.1050e / 20.1070e Security Update: avahi (UTSA-2025-991257)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991257 advisory. A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are...

EUVD-2025-203802

A stored cross-site scripting XSS vulnerability in the pagesave component of Linksys E5600 V1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hostname and domainName parameters...

EUVD-2025-203785

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix memory leak in cifsconstructtcon When having a multiuser mount with domain= specified and using cifscreds, cifssetcifscreds will end up setting @ctx-domainname, so it needs to be freed before leaving...

CVE-2025-29231

A stored cross-site scripting XSS vulnerability in the pagesave component of Linksys E5600 V1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hostname and domainName parameters...

CVE-2025-68295

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix memory leak in cifsconstructtcon When having a multiuser mount with domain= specified and using cifscreds, cifssetcifscreds will end up setting @ctx-domainname, so it needs to be freed before leaving...

CVE-2025-68295 smb: client: fix memory leak in cifs_construct_tcon()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix memory leak in cifsconstructtcon When having a multiuser mount with domain= specified and using cifscreds, cifssetcifscreds will end up setting @ctx-domainname, so it needs to be freed before leaving...

CVE-2025-68295 smb: client: fix memory leak in cifs_construct_tcon()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix memory leak in cifsconstructtcon When having a multiuser mount with domain= specified and using cifscreds, cifssetcifscreds will end up setting @ctx-domainname, so it needs to be freed before leaving...

CVE-2025-29231

A stored cross-site scripting XSS vulnerability in the pagesave component of Linksys E5600 V1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hostname and domainName parameters...

PT-2025-51737

Name of the Vulnerable Software and Affected Versions Linksys E5600 version V1.1.0.26 Description A stored cross-site scripting XSS issue exists in the page save component of the Linksys E5600. An attacker can inject a crafted payload into the hostname and domainName parameters, potentially leadi...

CVE-2025-29231

A stored cross-site scripting XSS vulnerability in the pagesave component of Linksys E5600 V1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hostname and domainName parameters...

CVE-2025-29231

The Linksys E5600 router (version V1.1.0.26 ) is vulnerable to a stored cross-site scripting (XSS) vulnerability in its page_save component. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the hostname and domainName parameters. Remediation involves updatin...