asteval 1.06 Arbitrary Code Execution / Sandbox Escape

An attacker who can pass input to the asteval library, when this is used with numpy functions in the symbol table the default setting, can bypass restrictions and execute arbitrary code as the user who ran the python process. Versions 1.06 and below are affected. CVE pending Sandboxing Python is...

CVE-2025-25565

SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in the Command.c file via the PtMakeCert and PtMakeCert2048 functions. NOTE: the Supplier disputes this because the behavior only allows a user to attack himself by typing a long string on a command line...

CVE-2025-25565

SoftEther VPN version 5.02.5187 is vulnerable to a Buffer Overflow in the Command.c file, specifically affecting the PtMakeCert and PtMakeCert2048 functions. While the supplier disputes the severity, claiming the behavior only allows a user to attack themselves by entering a long string on a comm...

Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities

Summary IBM QRadar SIEM includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. These have been addressed in the update. Vulnerability Details CVEID:CVE-2024-11187 DESCRIPTION: It is possible to construct a zone such that some queries ...

CVE-2025-1828

Crypt::Random Perl package 1.05 through 1.55 may use rand function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon egd service is not available Crypt::Random will default to use the...

ROS-20250311-07

PQescapeLiteral, PQescapeIdentifier, PQescapeString and PQescapeStringConn functions are vulnerable to vulnerability libpq library of PostgreSQL database management system is related to failure to take measures to protect SQL query structure. Exploitation of the vulnerability could allow an...

Zyxel EX5601-T1 操作系统命令注入漏洞

Zyxel EX5601-T1 is a dual-band wireless gateway from China Hopkins Zyxel. Operating system command injection vulnerability exists in Zyxel EX5601-T1 V5.70ACDZ.3.6C0 and earlier versions, which stems from a command injection in ZyEE functions that could lead to the execution of operating system...

CVE-2025-1828 Perl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions

Crypt::Random Perl package 1.05 through 1.55 may use rand function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon egd service is not available Crypt::Random will default to use the...

CVE-2025-1828

The Crypt::Random Perl package (versions 1.05 through 1.55 ) is vulnerable to the use of a cryptographically weak pseudo-random number generator (PRNG) . The issue occurs because the package may default to the insecure Crypt::Random::rand provider when a specific provider is not defined and /dev/...

GE Vernova EnerVista UR 访问控制错误漏洞

GE Vernova EnerVista UR is a device configuration tool from GE Vernova USA that is compatible with all UR relay applications. An access control error vulnerability exists in the GE Vernova EnerVista UR that stems from a lack of critical function authentication, which could lead to authentication...

Python JSON Logger Code Execution

The vulnerability of the Python JSON Logger library is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by deploying a specially crafted package...

CVE-2023-52969

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., and 11.0 through 11.0. can sometimes crash with an empty backtrace log. This may be related to makeaggrtablesinfo and optimizestage2...

Some AES functions may panic when overflow checking is enabled in ring

ring::aead::quic::HeaderProtectionKey::newmask may panic when overflow checking is enabled. In the QUIC protocol, an attacker can induce this panic by sending a specially-crafted packet. Even unintentionally it is likely to occur in 1 out of every 232 packets sent and/or received. On 64-bit targe...

Vue I18n Allows Prototype Pollution in `handleFlatJson`

Vulnerability type: Prototype Pollution Vulnerability Locations: js v9.1 nodemodules/@intlify/message-resolver/index.js v9.2 or later nodemodules/@intlify/vue-i18n-core/index.js Description: The latest version of @intlify/message-resolver 9.1 and @intlify/vue-i18n-core 9.2 or later, previous...

DEBIAN-CVE-2024-58079

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix crash during unbind if gpio unit is in use We used the wrong device for the device managed functions. We used the usb device, when we should be using the interface device. If we unbind the driver from the usb...

CVE-2024-58075

Technical details for CVE-2024-58075 are not publicly provided in the supplied documents. No listed affected products, versions, or remediation are specified here. Monitor for updates from vendor advisories and security feeds.

RUSTSEC-2025-0009 Some AES functions may panic when overflow checking is enabled.

ring::aead::quic::HeaderProtectionKey::newmask may panic when overflow checking is enabled. In the QUIC protocol, an attacker can induce this panic by sending a specially-crafted packet. Even unintentionally it is likely to occur in 1 out of every 232 packets sent and/or received. On 64-bit targe...

Important: postgresql16

Issue Overview: Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral, PQescapeIdentifier, PQescapeString, and PQescapeStringConn allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the...

Medium: ecs-init

Issue Overview: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. CVE-2024-45338 Affected Packages: ecs-init Note: This advisory is applicable to Amazon...

Linux Distros Unpatched Vulnerability : CVE-2024-49982

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 aoe: fix the potential use-after-free problem in aoecmdcfgpk...