PowerVR Patch Security Issues

A couple security issues were discovered in PowerVR during a patch review. While reviewing a preview patch for https://bugs.chromium.org/p/project-zero/issues/detail?id=2540 , I noticed some issues - most of them minor, but the following two seem like they probably have bigger security impact: F....

The vulnerability of the btrfs_force_cow_block() function in the fs/btrfs/ctree.c module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the btrfsforcecowblock function in the fs/btrfs/ctree.c module of the Linux kernel is related to the reutilization of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

CVE-2024-13376

The Industrial theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajaxgettotalcontentimportitems function in all versions up to, and including, 1.7.8. This makes it possible for authenticated...

CVE-2025-27893

In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy request via a GenericContent/Record.aspx?id= URI. NOTE: the Supplier analyzed the reported...

Critical vulnerabilities in SICK DL100-2xxxxxxx

Critical vulnerabilities have been found in the SICK device DL100-2xxxxxxx. If exploited, this potentially allows an attacker to impact availabiltiy, integrity and confidentaility of the products. Currently, SICK is not aware of any public exploits specifically targeting these vulnerabilities. As...

The vulnerability of the Default Header Filtering component in the Apache Camel framework, which is related to insufficient registry checks, allows attackers to influence the integrity, accessibility, and confidentiality of the protected information.

The vulnerability of the Default Header Filtering component in the Java framework of Apache Camel is related to insufficient registration checks. Exploiting this vulnerability allows an attacker to influence the integrity, availability, and confidentiality of the protected information...

ROS-20250314-02

A vulnerability in the wifi component of the Linux operating system kernel is related to an incorrect lock in the function ilpciresume in drivers/net/wireless/intel/iwlegacy/common.c. Exploitation of the vulnerability could allow an an attacker to cause a denial of service A vulnerability in the...

The vulnerability in the RegExp component of Mozilla Firefox, Firefox ESR, and the email client Thunderbird, Thunderbird ESR, allows attackers to influence the confidentiality and integrity of protected information.

The vulnerability of the RegExp component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird, Thunderbird ESR, is related to insufficient processing of regular expressions. Exploiting this vulnerability can allow an attacker to influence the confidentiality and integrity of protect...

The vulnerability of the xslt/txNodeSorter component in browsers such as Mozilla Firefox, Firefox ESR, and email clients like Thunderbird, Thunderbird ESR, allows attackers to influence the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the xslt/txNodeSorter component in browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird, Thunderbird ESR, is related to reading data beyond the permitted range of memory. Exploiting this vulnerability can allow an attacker to influence the...

The vulnerability of the nnq_Sigmoid() function in the Quantized Sigmoid Module framework of the PyTorch machine learning library allows attackers to exploit it to compromise the integrity of protected information.

The vulnerability of the nnqSigmoid function in the Quantized Sigmoid Module of the PyTorch machine learning framework is related to incorrect initialization of resources when processing parameters scale and zeropoint. Exploiting this vulnerability can allow attackers to compromise the integrity ...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to loss of integrity [CVE-2025-21502]

Summary IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to loss of data integrity due to a vulnerability in Java. This bulletin provides patch information to address the reported vulnerability in Java. CVE-2025-21502 Vulnerabili...

CVE-2025-21845

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: sst: Fix SST write failure 'commit 18bcb4aa54ea "mtd: spi-nor: sst: Factor out common write operation to sstnorwritedata"' introduced a bug where only one byte of data is written, regardless of the number of bytes...

JetBrains Ktor 环境问题漏洞

JetBrains Ktor is a web framework for building asynchronous servers and clients in Kotlin from the Czech company JetBrains. Used to create microservices, Web applications , etc., build RESTful API. JetBrains Ktor suffers from a security vulnerability that stems from the occurrence of an HTTP...

ROS-20250312-01

The vulnerability of thejd drm/amd/display component of the Linux kernel is related to incorrect verification of the input data in the calculatettucursor function in the drivers/gpu/drm/amd/display/dc/dml/dcn21/displayrqdlgcalc21.c, in the calculatettucursor function in the...

The vulnerability of the sqfs inode_size function in the U-Boot loader allows a attacker to influence the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sqfs inodesize function in the U-Boot loader is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the ext4fs_read_symlink function in the U-Boot loader allows a attacker to influence the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ext4fsreadsymlink function in the U-Boot loader is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2025-24078 Microsoft Word Remote Code Execution Vulnerability

...

CVE-2025-27893

In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy request via a GenericContent/Record.aspx?id= URI. NOTE: the Supplier analyzed the reported...

CVE-2025-27434

Due to insufficient input validation, SAP Commerce Swagger UI allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting XSS attack. This could lead to a high impact on the confidentiality, integrity...

CVE-2025-26658

The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unauthorized actions. Due to the improper session management, the attackers can elevate themselves to higher privilege and can read, modify...