IBM i security vulnerabilities

IBM i is a suite of operating systems from International Business Machines IBM running in IBM Power Systems and IBM PureSystems. A security vulnerability exists in IBM i version 7.6 that stems from improper configuration file swapping, which could result in elevated privileges to root...

PT-2025-17206 · Ibm · Ibm I

Name of the Vulnerable Software and Affected Versions: IBM i version 7.6 Description: The issue is related to a privilege escalation due to incorrect profile swapping in an OS command, allowing a malicious actor to gain root access to the host operating system. Recommendations: For IBM i version...

CVE-2025-2947: Insecure Preserved Inherited Permissions

IBM i 7.6 contains a privilege escalation vulnerability due to incorrect profile swapping in an OS command. A malicious actor can use the command to elevate privileges to gain root access to the host operating system...

CVE-2022-43590

A null pointer dereference vulnerability exists in the handleioctl0x830a0systembuffer functionality of Callback technologies CBFS Filter 20.0.8317. A specially crafted I/O request packet IRP can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability...

CVE-2022-43589

A null pointer dereference vulnerability exists in the handleioctl8314C functionality of Callback technologies CBFS Filter 20.0.8317. A specially crafted I/O request packet IRP can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability...

CVE-2022-43588

A null pointer dereference vulnerability exists in the handleioctl83150 functionality of Callback technologies CBFS Filter 20.0.8317. A specially crafted I/O request packet IRP can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability...

Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to a denial of service

Summary IBM i Modernization Engine for Lifecycle Integration keycloak component is vulnerable to a denial of service CVE-2023-6841 as described in the Vulnerability Details section. These components are used in IBM i Modernization Engine for Lifecycle Integration for infrastructure support in the...

This Week in Spring - April 15th, 2025

Spring AI M7 is here! This new release includes a bunch of awesome new features! And some refactorings. Notably that the Spring AI auto-configuration has changed from a single monolithic artifact to individual auto-configuration artifacts per model, vector store, and other components. This change...

IBMi Navigator 7.5 - HTTP Security Token Bypass

Author Title: John Page aka hyp3rlinx Author Website: hyp3rlinx.altervista.org Source: https://hyp3rlinx.altervista.org/advisories/IBMiNavigatorHTTPSecurityTokenBypass-CVE-2024-51464.txt Vendor: www.ibm.com Product Navigator for i is a Web console interface where you can perform the key tasks to...

IBMi Navigator 7.5 - Server Side Request Forgery (SSRF)

Author Title: John Page aka hyp3rlinx Author Website: hyp3rlinx.altervista.org Source: https://hyp3rlinx.altervista.org/advisories/IBMiNavigatorHTTPSecurityTokenBypass-CVE-2024-51464.txt Vendor: www.ibm.com Vendor www.ibm.com Product Navigator for i is a Web console interface where you can perfor...

Security Bulletin: IBM i is vulnerable to an out-of-bounds write in NTP services due to multiple vulnerabilities.

Summary IBM i is vulnerable to an out-of-bounds write due to a flaw in mstolfp.c in NTP CVE-2023-26551, CVE-2023-26552, CVE-2023-26553, and CVE-2023-26554 as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerabilities as described in t...

ibmvnic: Don't reference skb after sending to VIOS

...

SUSE CVE-2025-30427

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2025-32624: Missing Authorization

Missing Authorization vulnerability in czater Czater.pl – live chat i telefon czater allows Cross Site Request Forgery.This issue affects Czater.pl – live chat i telefon: from n/a through = 1.0.5...

Ubuntu 24.04 LTS : Linux kernel (OEM) vulnerabilities (USN-7382-1)

"The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7382-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws i...

CVE-2025-31443

Cross-Site Request Forgery CSRF vulnerability in Krzysztof Furtak KK I Like It kk-i-like-it allows Stored XSS.This issue affects KK I Like It: from n/a through = 1.7.5.3...

CVE-2024-58091

In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Add shadow buffering for deferred I/O DMA areas are not necessarily backed by struct page, so we cannot rely on it for deferred I/O. Allocate a shadow buffer for drivers that require deferred I/O and use it as...

CVE-2025-31443

Cross-Site Request Forgery CSRF vulnerability in Krzysztof Furtak KK I Like It kk-i-like-it allows Stored XSS.This issue affects KK I Like It: from n/a through = 1.7.5.3...

CVE-2025-31443

CVE-2025-31443 : In the WordPress plugin KK I Like It, a Cross-Site Request Forgery (CSRF) vulnerability can lead to a Stored Cross-Site Scripting (XSS) condition. Affected software is KK I Like It versions up to 1.7.5.3 (inclusive). The connected WordFence vulnerability details indicate this ent...

CVE-2025-31443 WordPress KK I Like It plugin <= 1.7.5.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Krzysztof Furtak KK I Like It allows Stored XSS. This issue affects KK I Like It: from n/a through 1.7.5.3...