Cross-Site Scripting (XSS)

yeswiki/yeswiki is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper input sanitization in the comments feature, allowing obfuscated JavaScript payloads to bypass filters and execute in users' browsers...

perftest bug fix and enhancement update

An update is available for perftest. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 8.1...

CVE-2025-20162

A vulnerability in the DHCP snooping security feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a full interface queue wedge, which could result in a denial of service DoS condition. This vulnerability is due to improper handling of DHCP request packets. An...

CVE-2025-4316

Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user interface actions. This issue affects Devolutions Server versions from 2025.1.3.0 through 2025.1.6.0, and all versions up...

PT-2025-20062 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.4.29.23 Description: The issue concerns the use of implicit intent for sensitive communication in translation, allowing local attackers to obtain sensitive information. User interaction is required to trigger...

org.jboss.hal:hal-standalone (>=3.5.0.final, <=3.7.10.final), org.wildfly:wildfly-ee-feature-pack-common (>=28.0.0.beta1, <=28.0.1.final) +3 more potentially affected by CVE-2025-2901 via org.jboss.hal:hal-console (>=3.5.0.final, <=3.7.10.final)

org.jboss.hal:hal-console MAVEN version =3.5.0.final, =3.5.0.final, =28.0.0.beta1, =29.0.0.alpha1, =28.0.0.beta1, =28.0.0.beta1, =36.0.0.final Source cves: CVE-2025-2901 Source advisory: OSV:GHSA-F7JH-M6WP-JM7F...

org.jboss.hal:hal-standalone (>=3.5.0.final, <=3.7.10.final), org.wildfly:wildfly-ee-feature-pack-common (>=28.0.0.beta1, <=28.0.1.final) +3 more potentially affected by CVE-2025-2901 via org.jboss.hal:hal-console (>=3.5.0.final, <=3.7.10.final)

org.jboss.hal:hal-console MAVEN version =3.5.0.final, =3.5.0.final, =28.0.0.beta1, =29.0.0.alpha1, =28.0.0.beta1, =28.0.0.beta1, =36.0.0.final Source cves: CVE-2025-2901 Source advisory: GHSA-F7JH-M6WP-JM7F...

QEMU: virtio-net: stack buffer overflow in virtio_net_flush_tx()

A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtionetflushtx function if guest features VIRTIONETFHASHREPORT, VIRTIOFVERSION1 and VIRTIONETFMRGRXBUF are enabled. This could allow a malicious user to overwrite local variables...

qemu-kvm security update

9.0.0-10.el95.3 - kvm-target-i386-fix-feature-dependency-for-WAITPKG.patch RHEL-84866 - Resolves: RHEL-84866 Live migration after workload update fails with operation failed: guest CPU doesn't match specification: missing features: waitpkg rhel-9.5.z...

PT-2025-20553

Name of the Vulnerable Software and Affected Versions: Unifi Protect Application versions 5.3.41 and earlier Description: The issue is related to a misconfigured access token mechanism in the Share Livestream feature of the Unifi Protect Application. This could allow an unauthorized user to...

Detecting Quishing Attacks with Machine Learning Techniques through QR Code Analysis

The rise of QR code based phishing "Quishing" poses a growing cybersecurity threat, as attackers increasingly exploit QR codes to bypass traditional phishing defenses. Existing detection methods predominantly focus on URL analysis, which requires the extraction of the QR code payload, and may...

CVE-2025-45236

A stored cross-site scripting XSS vulnerability in the Edit Profile feature of DBSyncer v2.0.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Nickname parameter...

PYSEC-2025-179

OpenCTI is an open cyber threat intelligence CTI platform. Prior to version 6.4.11 any user with the capability manage customizations can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the...

CVE-2025-4316

Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user interface actions. This issue affects Devolutions Server versions from 2025.1.3.0 through 2025.1.6.0, and all versions up...

CVE-2025-4316

Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user interface actions. This issue affects Devolutions Server versions from 2025.1.3.0 through 2025.1.6.0, and all versions up...

CVE-2025-4316

The Devolutions Server platform contains an improper access control vulnerability in its PAM feature . This flaw allows a PAM user to self-approve their own PAM requests via specific user interface actions, even when the configured policy explicitly disallows such actions. The vulnerability is pr...

CVE-2025-4316

Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user interface actions. This issue affects Devolutions Server versions from 2025.1.3.0 through 2025.1.6.0, and all versions up...

dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature

...

CVE-2025-45321

Kashipara Online Service Management Portal V1.0 is affected by a SQL Injection in the /osms/Requester/Requesterchangepass.php endpoint, exploited via the rPassword parameter. The underlying cause is improper handling of this parameter, enabling an attacker to perform injection attacks. CVSS v3.1 ...

Devolutions Server security vulnerabilities

Devolutions Server is an application from Devolutions Canada Inc. It provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2025.1.6.0 and prior versions, which stems from improper access control of the PAM feature a...