15674 matches found
CVE-2022-50045
CVE-2022-50045 is a Linux kernel issue affecting the powerpc/pci path. The vulnerability arose from a locking interaction in get_phb_number(), which could cause a DEBUG_ATOMIC_SLEEP warning when sleep-prone OF routines are called while a hose_spinlock is held. The resolution involves modifying ge...
CVE-2025-40726
Reflected Cross-Site Scripting XSS vulnerability in /pages/search-results-page in Nosto, which allows remote attackers to execute arbitrary code via the q GET request parameter...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from unreleased node references in xivegetmaxprio, which could lead to a reference count leak...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from an unhandled nfsgetlockcontext failure that could result in a null pointer dereference...
PT-2025-26073 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to an out-of-bounds access in the get nodes function when a user specifies more nodes than supported, causing the function to access the nmask array out of bounds...
commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like...
Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12
In the Linux kernel, the following vulnerabilities have been resolved: proc: Fixed a UAF in procgetinode. Fixed a race condition between rmmod and the instantiation of /proc/XXX’s inode. The bug is that pde-procops does not belong to /proc; it belongs to a module. Therefore, dereferencing it afte...
Astra Linux - Vulnerability in linux-6.12
In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix null-ptr-deref in applesoccpufreqgetrate cpufreqcpugetraw can return NULL when the target CPU is not present in the policy-cpus mask. applesoccpufreqgetrate does not check for this case, which results in a...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: pktgen: Avoid out-of-bounds access in getimixentries Passing a sufficient amount of imix entries leads to invalid access to the pktdev-imixentries array due to incorrect boundary checks. UBSAN: Array-index out-of-bounds in...
CVE-2025-40727
A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...
kernel: proc: fix UAF in proc_get_inode()
In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in procgetinode Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde-procops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered...
CVE-2025-40726 Cross-Site Scripting (XSS) reflected in Nosto
Reflected Cross-Site Scripting XSS vulnerability in /pages/search-results-page in Nosto, which allows remote attackers to execute arbitrary code via the q GET request parameter...
CVE-2025-40726
CVE-2025-40726 is a reflected XSS vulnerability in Nosto exposed on the /pages/search-results-page endpoint. The issue allows an attacker to trigger arbitrary code execution via the q GET parameter. The CVSS base score is 5.1 (Medium); attack vector is network, with low attack complexity, no priv...
CVE-2025-40727
Consolidated findings for CVE-2025-40727: The Phoenix Site CMS contains a Reflected XSS vulnerability in the /search endpoint, exploitable via the s GET parameter. The root cause is reflected input being echoed unsafely, enabling remote attackers to execute arbitrary code in the context of the af...
CVE-2025-40727 Reflected Cross-Site Scripting (XSS) in Phoenix CMS
A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...
CVE-2025-40727 Reflected Cross-Site Scripting (XSS) in Phoenix CMS
A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...
CVE-2025-46035
Buffer Overflow vulnerability in Tenda AC6 v.15.03.05.16 allows a remote attacker to cause a denial of service via the oversized schedStartTime and schedEndTime parameters in an unauthenticated HTTP GET request to the /goform/openSchedWifi endpoint...
CVE-2025-49150
Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent...
SUSE-SU-2025:01944-1 Security update for the Linux Kernel (Live Patch 6 for SLE 15 SP6)
This update for the Linux Kernel 6.4.0-1506002330 fixes several issues. The following security issues were fixed: - CVE-2025-21680: pktgen: Avoid out-of-bounds access in getimixentries bsc1236701. - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmtremoveadvmonitorsync...
CVE-2024-34711
GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities XEE attack, then send GET request to any HTTP server. By default, GeoServer use...