CVE-2025-56161

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields bcrypt password hash, mobile...

PT-2025-40399

Name of the Vulnerable Software and Affected Versions YOSHOP 2.0 Description The software allows unauthorized disclosure of information through comment-list API endpoints within the Goods module. The Comment model loads the related User model without filtering specific fields. Due to the absence ...

PT-2025-40401

Name of the Vulnerable Software and Affected Versions Vasion Print formerly PrinterLogic Virtual Appliance Host and Application VA/SaaS deployments affected versions not specified Description The software stores user passwords using unsalted SHA-512 hashes, with a fallback to unsalted SHA-1. The...

CVE-2025-56161

The YOSHOP 2.0 e-commerce system contains an unauthenticated information disclosure vulnerability within the Goods module comment-list API endpoints. The root cause is that the Comment model eagerly loads the User model without applying field filters. Because the User.php file lacks $hidden or $v...

SUSE CVE-2023-53473

In the Linux kernel, the following vulnerability has been resolved: ext4: improve error handling from ext4dirhash The ext4dirhash will almost never fail, especially when the hash tree feature was first introduced. However, with the addition of support of encrypted, casefolded file names, that...

SUSE CVE-2025-39894

In the Linux kernel, the following vulnerability has been resolved: netfilter: brnetfilter: do not check confirmed bit in brnflocalin after confirm When send a broadcast packet to a tap device, which was added to a bridge, brnflocalin is called to confirm the conntrack. If another conntrack with...

njs:njs_process_script_fuzzer: Heap-use-after-free in njs_lexer_hash_test

Detailed Report: https://oss-fuzz.com/testcase?key=4597225159458816 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzerasannjs Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x7d4e88c5668e Crash State: njslexerhashtest...

UBUNTU-CVE-2023-53473

In the Linux kernel, the following vulnerability has been resolved: ext4: improve error handling from ext4dirhash The ext4dirhash will almost never fail, especially when the hash tree feature was first introduced. However, with the addition of support of encrypted, casefolded file names, that...

CVE-2025-39894

In the Linux kernel, the following vulnerability has been resolved: netfilter: brnetfilter: do not check confirmed bit in brnflocalin after confirm When send a broadcast packet to a tap device, which was added to a bridge, brnflocalin is called to confirm the conntrack. If another conntrack with...

AZL-74745 CVE-2025-39894 affecting package kernel for versions less than 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: brnetfilter: do not check confirmed bit in brnflocalin after confirm When send a broadcast packet to a tap device, which was added to a bridge, brnflocalin is called to confirm the conntrack. If another conntrack with...

UBUNTU-CVE-2025-39894

In the Linux kernel, the following vulnerability has been resolved: netfilter: brnetfilter: do not check confirmed bit in brnflocalin after confirm When send a broadcast packet to a tap device, which was added to a bridge, brnflocalin is called to confirm the conntrack. If another conntrack with...

CVE-2025-39894

The CVE-2025-39894 issue is in the Linux kernel netfilter br_netfilter path: br_nf_local_in() confirms conntrack during handling of a broadcast to a tap device added to a bridge. If another conntrack with the same hash is added, a warning can be emitted. The root cause is br_nf_local_in() using t...

CVE-2025-39894 netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm

In the Linux kernel, the following vulnerability has been resolved: netfilter: brnetfilter: do not check confirmed bit in brnflocalin after confirm When send a broadcast packet to a tap device, which was added to a bridge, brnflocalin is called to confirm the conntrack. If another conntrack with...

CVE-2025-39894 netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm

In the Linux kernel, the following vulnerability has been resolved: netfilter: brnetfilter: do not check confirmed bit in brnflocalin after confirm When send a broadcast packet to a tap device, which was added to a bridge, brnflocalin is called to confirm the conntrack. If another conntrack with...

kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: fix crash due to removal of uninitialised entry A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: exception RIP: nfctdeletefromlists+172 .. 7...

kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: fix crash due to removal of uninitialised entry A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: exception RIP: nfctdeletefromlists+172 .. 7...

CVE-2025-56513

NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An attacker capable of intercepting or redirecting traffic to the update url and can hijack the update process and deliver arbitrary executables that are automatically executed,...

NewStart CGSL MAIN 6.06 : ruby Multiple Vulnerabilities (NS-SA-2025-0208)

The remote NewStart CGSL host, running version MAIN 6.06, has ruby packages installed that are affected by multiple vulnerabilities: - CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks vi...

CVE-2025-56513

A critical supply-chain vulnerability in NiceHash QuickMiner v6.12.0 allows for Remote Code Execution (RCE) via a Man-in-the-Middle (MITM) attack. The software's auto-update mechanism retrieves metadata and downloads binaries over unencrypted HTTP without performing digital signature verification...

PT-2025-40013

Name of the Vulnerable Software and Affected Versions NiceHash QuickMiner version 6.12.0 Description The software updates are performed over HTTP without validating digital signatures or hash checks. An attacker intercepting or redirecting traffic to the update URL can hijack the update process a...