CVE-2025-59154

Openfire’s SASL EXTERNAL client TLS authentication uses X509Certificate.getSubjectDN().getName() with a regex to extract CN, producing a provider-dependent string that can fail to escape characters. This allows crafted DN values (e.g., OU="CN=admin,") to masquerade as another user by spoofing the...

CVE-2025-59154 Openfire allows potential identity spoofing via unsafe CN parsing

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...

External Control of System or Configuration Setting

Overview Affected versions of this package are vulnerable to External Control of System or Configuration Setting in the staging of live sites. An attacker can exfiltrate sensitive data to an external server by supplying malicious values for the remoteAddress and remotePort parameters. Note: This ...

External Control of System or Configuration Setting

Overview Affected versions of this package are vulnerable to External Control of System or Configuration Setting in the staging of live sites. An attacker can exfiltrate sensitive data to an external server by supplying malicious values for the remoteAddress and remotePort parameters. Note: This ...

CVE-2023-53166

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix externalpowerchanged race bq25890chargerexternalpowerchanged dereferences bq-charger, which gets sets in bq25890powersupplyinit like this: bq-charger = devmpowersupplyregisterbq-dev, &bq-desc, &psycfg;...

DEBIAN-CVE-2023-53166

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix externalpowerchanged race bq25890chargerexternalpowerchanged dereferences bq-charger, which gets sets in bq25890powersupplyinit like this: bq-charger = devmpowersupplyregisterbq-dev, &bq-desc, &psycfg;...

UBUNTU-CVE-2023-53166

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix externalpowerchanged race bq25890chargerexternalpowerchanged dereferences bq-charger, which gets sets in bq25890powersupplyinit like this: bq-charger = devmpowersupplyregisterbq-dev, &bq-desc, &psycfg;...

CVE-2023-53166 power: supply: bq25890: Fix external_power_changed race

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix externalpowerchanged race bq25890chargerexternalpowerchanged dereferences bq-charger, which gets sets in bq25890powersupplyinit like this: bq-charger = devmpowersupplyregisterbq-dev, &bq-desc, &psycfg;...

CVE-2023-53166 power: supply: bq25890: Fix external_power_changed race

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix externalpowerchanged race bq25890chargerexternalpowerchanged dereferences bq-charger, which gets sets in bq25890powersupplyinit like this: bq-charger = devmpowersupplyregisterbq-dev, &bq-desc, &psycfg;...

CVE-2023-53166

CVE-2023-53166 is a Linux kernel race in the bq25890 charger driver. The external_power_changed callback dereferenced bq->charger before it was guaranteed to be set during power_supply_init, creating a potential NULL pointer dereference in early boot when the extcon power is detected. The vuln...

CVE-2025-59378

creationtimestamp| type| source ---|---|--- 2025-09-15 09:47:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lyujm7k7fw2t...

CVE-2025-41713

creationtimestamp| type| source ---|---|--- 2025-09-15 08:03:49+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3lyudnqaimac2 2025-09-15 10:04:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lyukktjkgn2c...

MAL-2025-47204 Malicious code in setup-helper-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c02c25d78f51cf02062df08594fff995746429e6c4ba2e74b5a6fbddfcfb3e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lovable-cookies-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2866fddcd00a7e51784a043c672960b21264ee2449d71b72d5382f7ab14050b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-37774

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.51 through 7.4.3.109 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Liferay DXP 7.4 update 51 through update 92 Liferay DXP 7.3 update 33 through update 35 Description: A stored cross-site scripting XSS...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

PT-2025-37756

Name of the Vulnerable Software and Affected Versions: Openfire versions prior to 5.0.2 Openfire version 5.1.0 Description: Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a flaw in how it extracts user identities from X.509 certificates. The code uses...

PT-2025-37530

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The bq25890 charger external power changed function in the Linux kernel could experience a NULL pointer dereference. This occurs because the function may be called before the bq-charge...

browsersploit

This is an advanced browser exploit pack for internal and external pentesting, aiming to gain access to internal computers. The tool is not for script kiddies or non-advanced coders, as it contains bugs and is intended for experienced users. The pack includes various techniques to bypass antiviru...

wazuh

This repository is an open-source security platform called Wazuh, which provides unified XDR and SIEM protection for endpoints and cloud workloads. The repository contains various files and templates for issue reporting, testing, and integration with external services. The probable entry points f...