sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems

A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...

sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems

A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...

Important: Red Hat Security Advisory: bind security update

An update for bind is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2025-64163

DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. However, omission of protection for the dns:// protocol results in an SSRF vulnerability. This issue is fixed in version 2.10.15...

CVE-2025-61084

MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing eve...

DataEase 代码问题漏洞

DataEase is an open source data visualization and analysis tool from DataEase Open Source. It is used to help users quickly analyze data and gain insight into business trends for business improvement and optimization. A code issue vulnerability exists in DataEase version 2.10.14 and versions prio...

ALSA-2025:19912 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

Ubuntu: Security Advisory (USN-7855-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-64163 DataEase's DB2 is vulnerable to SSRF

DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. However, omission of protection for the dns:// protocol results in an SSRF vulnerability. This issue is fixed in version 2.10.15...

EUVD-2025-37958

DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. However, omission of protection for the dns:// protocol results in an SSRF vulnerability. This issue is fixed in version 2.10.15...

MAL-2025-49365 Malicious code in dunnhumby-component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b047f32f0323beace719a36eec364b2d804d556202950dae7942b04e2f2b09a The package dunnhumby-component-library was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in dunnhumby-component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b047f32f0323beace719a36eec364b2d804d556202950dae7942b04e2f2b09a The package dunnhumby-component-library was found to contain malicious code. Source: ossf-package-analysis...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

MAL-2025-49364 Malicious code in supply_chain_supplyer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffb82b4b36d6e82b7dff16e757aab9bf7ffce58bcd579bd38ad7cdd98da4c3e5 The package supplychainsupplyer was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in supply_chain_supplyer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffb82b4b36d6e82b7dff16e757aab9bf7ffce58bcd579bd38ad7cdd98da4c3e5 The package supplychainsupplyer was found to contain malicious code. Source: ossf-package-analysis...

PT-2025-45159

Name of the Vulnerable Software and Affected Versions SelfBest platform version 2023.3 Description A DOM-based Cross-Site Scripting XSS issue exists in the SelfBest platform. This allows attackers to execute arbitrary JavaScript within a logged-in user's session. The attack vector involves...

MDaemon Mail Server 安全漏洞

MDaemon Mail Server is an e-mail server software from MDaemon Inc. in the United States. A security vulnerability exists in MDaemon Mail Server version 23.5.2, which originates from a flaw in the use of email validation SPF, DKIM, and DMARC using the pointed brackets in the From header of the SMT...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988682)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988682 advisory. In the Linux kernel, the following vulnerability has been resolved: tipc: improve size validations for received domain records The function tipcmonrcv allows a node ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989887)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989887 advisory. In the Linux kernel, the following vulnerability has been resolved: mfd: intelsocpmicbxtwc: Use IRQ domain for USB Type-C device While design wise the idea of...

Amazon Linux 2 : unbound, --advisory ALAS2UNBOUND-1.17-2025-006 (ALASUNBOUND-1.17-2025-006)

The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2UNBOUND-1.17-2025-006 advisory. NLnet Labs Unbound up to and including version 1.24.0 is vulnerable to possible domain hijack attacks. Promiscuous NS...