CVE-2025-8312

CVE-2025-8312 describes a deadlock in Devolutions Server’s PAM automatic check-in feature that can allow a password to stay valid past its intended check-out. Affected versions include Devolutions Server 2025.2.2.0 through 2025.2.5.0 and 2025.1.12.0 and earlier. The root cause is a scheduling-ser...

UBUNTU-CVE-2025-52897

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

CVE-2025-52897 GLPI is vulnerable to XSS and open redirection attacks through planning feature

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

CVE-2025-52897 GLPI is vulnerable to XSS and open redirection attacks through planning feature

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

CVE-2025-52897 GLPI is vulnerable to XSS and open redirection attacks through planning feature

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

GHSA-6V2P-P543-PHR9 vulnerabilities

Vulnerabilities for packages: ansible-operator, crossplane-provider-aws-ec2, kubeflow-pipelines, grype-fips, packer-fips, git-credential-oauth, cue, crossplane-provider-aws-s3, amazon-ssm-agent, rabbitmq-cluster-operator-fips, rclone-fips, descheduler-fips, cosign, sbomqs,...

CVE-2025-8321

Tesla Wall Connector Firmware Downgrade Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Tesla Wall Connector devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

GLPI 安全漏洞

GLPI is a free asset and IT management software suite. A phishing attack vulnerability exists in GLPI versions 9.1.0 through 10.0.18, which stems from a planning feature that does not effectively filter malicious links sent by unauthenticated users. An attacker could use this vulnerability to...

PT-2025-31414 · Devolutions · Devolutions Server

Name of the Vulnerable Software and Affected Versions: Devolutions Server versions 2025.2.5.0 and earlier Description: A deadlock in the PAM automatic check-in feature allows a password to remain valid beyond its intended check-out period. This is due to a deadlock occurring in the scheduling...

CVE-2025-38470

CVE-2025-38470 affects the Linux kernel VLAN handling when 8021q rx-vlan-filter is enabled. It can cause VLAN 0 to be emulated on NETDEV_UP/DC_DOWN, leading to a memory leak if VLAN 0 is not removed, or a potential null-vlan_info path triggering a BUG_ON during device teardown. Root cause: refcnt...

CVE-2025-38470

In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the "rx-vlan-filter" feature is enabled on a net device, the 8021q module will automatically add or remove VLAN 0 when the net device is put...

FreeBSD : Mozilla -- Insufficient input escaping (44b3048b-685e-11f0-a12d-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 44b3048b-685e-11f0-a12d-b42e991fc52e advisory. [email protected] reports: Insufficient escaping in the Copy as cURL feature could potentially be us...

Security update for deepin-feature-enable (moderate)

openSUSE Security Update: Security update for deepin-feature-enable Announcement ID: openSUSE-SU-2025:0156-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP6 An update that contains security fixes can now be installed. Description: This update for deepin-feature-enabl...

CVE-2025-52360

A Cross-Site Scripting XSS vulnerability exists in the OPAC search feature of Koha Library Management System v24.05. Unsanitized input entered in the search field is reflected in the search history interface, leading to the execution of arbitrary JavaScript in the browser context when the user...

Missing Authentication

backend.ai is vulnerable to Missing Authentication. The vulnerability is due to improper access control caused by lack of authentication checks in the registration feature, allowing arbitrary users to create accounts and access private data even when registration is disabled...

CVE-2025-52360

A Cross-Site Scripting XSS vulnerability exists in the OPAC search feature of Koha Library Management System v24.05. Unsanitized input entered in the search field is reflected in the search history interface, leading to the execution of arbitrary JavaScript in the browser context when the user...

CVE-2025-52360

CVE-2025-52360 affects Koha Library Management System (OPAC search) v24.05. Unfiltered input in the search field is reflected in the search history UI, enabling execution of arbitrary JavaScript in the browser context when users interact with the interface. The connected sources confirm the vulne...

Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by CVE-2024-38434

Summary IBM Engineering Systems Design Rhapsody was vulnerable to use of Potentially Dangerous Function which may allow security feature bypass Vulnerability Details CVEID:CVE-2024-38434 DESCRIPTION: Unitronics Vision PLC – CWE-676: Use of Potentially Dangerous Function may allow security feature...

📄 Invision Community 4.7.20 SQL Injection

Invision Community versions 4.7.20 and below have a vulnerability located within the /applications/calendar/modules/front/calendar/view.php script. Specifically, in the IPS\calendar\modules\front\calendar\view::search method: user input passed through the location request parameter is not properl...

CVE-2025-8030 Potential user-assisted code execution in “Copy as cURL” command

Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1...