Google Go 安全漏洞

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, Inc USA. A security vulnerability exists in Google Go, which stems from the ParseAddress function constructing a domain literal address component by repeating string concatenation...

PT-2025-44275

Name of the Vulnerable Software and Affected Versions Call Now Button versions prior to 1.5.5 Description The Call Now Button plugin for WordPress is susceptible to unauthorized data access because of a missing capability check in multiple functions. Attackers with Subscriber-level access or high...

ISC BIND 9 Denial of Service Vulnerability

ISC BIND 9 is a domain name system software from the ISC organization. A denial of service vulnerability exists in ISC BIND 9, which arises from improper resource consumption when processing malformed DNSKEY records in specially crafted zones, and can be exploited by an attacker to cause CPU...

Siemens SIMATIC Devices Channel Accessible by Non-Endpoint (CVE-2023-7008)

A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles or the upstream DNS resolver to manipulate records. This plugin only works with Tenable.ot. Please visit...

Malicious code in terminal-kleur (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb7974c4fea6be8468d7f37887f3a894f3f1c3b8ba50ee5f6eb49872ce93ddc The package terminal-kleur was found to contain malicious code. Source: ghsa-malware 7aeaeb943d666c429839011345be810a0f587322d34b0b03308f43cd1f9611f5...

MAL-2025-48950 Malicious code in terminal-kleur (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb7974c4fea6be8468d7f37887f3a894f3f1c3b8ba50ee5f6eb49872ce93ddc The package terminal-kleur was found to contain malicious code. Source: ghsa-malware 7aeaeb943d666c429839011345be810a0f587322d34b0b03308f43cd1f9611f5...

CVE-2025-59837

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...

CVE-2025-59837

Astro (web framework) versions 5.13.4–5.13.9 vulnerable to image proxy domain validation bypass via backslashes in the href, enabling server-side requests to arbitrary URLs and potentially SSRF and XSS. Root cause: incomplete fix for CVE-2025-58179; fix implemented in 5.13.10. Affected component:...

EUVD-2025-36542

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...

CVE-2025-59837 astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...

CVE-2025-59837 astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...

CVE-2025-59837 astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...

New TEE.Fail Side-Channel Attack Extracts Secrets from Intel and AMD DDR5 Secure Enclaves

A group of academic researchers from Georgia Tech, Purdue University, and Synkhronix have developed a side-channel attack called TEE.Fail that allows for the extraction of secrets from the trusted execution environment TEE in a computer's main processor, including Intel's Software Guard eXtension...

GHSA-QCPR-679Q-RHM2 Astro's bypass of image proxy domain validation leads to SSRF and potential XSS

Summary This is a patch bypass of CVE-2025-58179 in commit 9ecf359. The fix blocks http://, https:// and //, but can be bypassed using backslashes \ - the endpoint still issues a server-side fetch. PoC...

EUVD-2025-36515

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLSHOSTNAME parameter when adding a new DNS entry. When a user adds a DNS entry, the application issues an HT...

CVE-2025-34317 IPFire < v2.29 Stored XSS via DNS Creation (dns.cgi)

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLSHOSTNAME parameter when adding a new DNS entry. When a user adds a DNS entry, the application issues an HT...

CVE-2025-34317 IPFire < v2.29 Stored XSS via DNS Creation (dns.cgi)

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLSHOSTNAME parameter when adding a new DNS entry. When a user adds a DNS entry, the application issues an HT...

CVE-2025-40076

In the Linux kernel, the following vulnerability has been resolved: PCI: rcar-host: Pass proper IRQ domain to generichandledomainirq Starting with commit dd26c1a23fd5 "PCI: rcar-host: Switch to msicreateparentirqdomain", the MSI parent IRQ domain is NULL because the object of type struct...

CVE-2025-40080

In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 "nbd: verify socket is supported during setup" made sure the socket supported a shutdown method. Explicitel...

UBUNTU-CVE-2025-40076

In the Linux kernel, the following vulnerability has been resolved: PCI: rcar-host: Pass proper IRQ domain to generichandledomainirq Starting with commit dd26c1a23fd5 "PCI: rcar-host: Switch to msicreateparentirqdomain", the MSI parent IRQ domain is NULL because the object of type struct...