The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.

...

FILTER_VALIDATE_URL accepts URLs with invalid userinfo

...

PT-2025-52894

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the btrfs file system related to race conditions during bitfield writes within the btrfs clear space info full function. The issue stems from the use ...

CVE-2022-50446

In the Linux kernel, the following vulnerability has been resolved: ARC: mm: fix leakage of memory allocated for PTE Since commit d9820ff "ARC: mm: switch pgtablet back to struct page " a memory leakage problem occurs. Memory allocated for page table entries not released during process terminatio...

SUSE CVE-2023-53462

In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in fillframeinfo Syzbot reports the following uninit-value access problem. ===================================================== BUG: KMSAN: uninit-value in fillframeinfo net/hsr/hsrforward.c:601 inli...

CVE-2023-53517

In the Linux kernel, the following vulnerability has been resolved: tipc: do not update mtu if msgmax is too small in mtu negotiation When doing link mtu negotiation, a malicious peer may send Activate msg with a very small mtu, e.g. 4 in Shuang's testing, without checking for the minimum mtu,...

CVE-2023-53503

In the Linux kernel, the following vulnerability has been resolved: ext4: allow ext4getgroupinfo to fail Previously, ext4getgroupinfo would treat an invalid group number as BUG, since in theory it should never happen. However, if a malicious attaker or fuzzer modifies the superblock via the block...

CVE-2023-53449

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential memleak in dasdeckdinit dasdreservereq is allocated before dasdvolinforeq, and it also needs to be freed before the error returns, just like the other cases in this function...

UBUNTU-CVE-2023-53509

In the Linux kernel, the following vulnerability has been resolved: qed: allow sleep in qedmcptracedump By default, qedmcpcmdandunion delays 10us at a time in a loop that can run 500K times, so calls to qedmcpnvmrdcmd may block the current thread for over 5s. We observed thread scheduling delays...

UBUNTU-CVE-2023-53462

In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in fillframeinfo Syzbot reports the following uninit-value access problem. ===================================================== BUG: KMSAN: uninit-value in fillframeinfo net/hsr/hsrforward.c:601 inli...

CVE-2023-53503 ext4: allow ext4_get_group_info() to fail

In the Linux kernel, the following vulnerability has been resolved: ext4: allow ext4getgroupinfo to fail Previously, ext4getgroupinfo would treat an invalid group number as BUG, since in theory it should never happen. However, if a malicious attaker or fuzzer modifies the superblock via the block...

CVE-2023-53462

Summary: The CVE concerns the Linux kernel HID/HSR driver (net/hsr/hsr_forward.c). A KMSAN-uninitialized-value access is reported in fill_frame_info() when VLAN (ETH_P_8021Q) is encountered, due to VLAN not being supported in the hsr driver. The issue is resolved by returning an error from fill_f...

CVE-2023-53462 hsr: Fix uninit-value access in fill_frame_info()

In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in fillframeinfo Syzbot reports the following uninit-value access problem. ===================================================== BUG: KMSAN: uninit-value in fillframeinfo net/hsr/hsrforward.c:601 inli...

CVE-2023-53449

CVE-2023-53449 affects the Linux kernel in the s390/dasd area. The root cause was a potential memory leak in dasd_eckd_init() where dasd_reserve_req was allocated before dasd_vol_info_req and could not be freed on error. The fix ensures dasd_reserve_req is freed before error returns, matching the...

kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: Ensure scpiinfo is not assigned if the probe fails When scpi probe fails, at any point, we need to ensure that the scpiinfo is not set and will remain NULL until the probe succeeds. If it is not taken care, the...

CVE-2025-11080

CVE-2025-11080 affects zhuimengshaonian wisdom-education up to 1.0.4. The vulnerability lies in ExamInfoController.java, in the selectStudentExamInfoList function, where manipulation of the subjectId parameter leads to improper authorization. Itمكن be exploited remotely and the exploit has been p...

CVE-2025-11080 zhuimengshaonian wisdom-education ExamInfoController.java selectStudentExamInfoList improper authorization

A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. This vulnerability affects the function selectStudentExamInfoList of the file src/main/java/com/education/api/controller/student/ExamInfoController.java. Such manipulation of the argument subjectId leads ...

CVE-2025-10992 roncoo roncoo-pay lookupList improper authorization

A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/lookupList. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly...

CVE-2025-10992: Improper Authorization

A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/lookupList. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly...

PT-2025-39449

Name of the Vulnerable Software and Affected Versions MuFen-mker PHP-Usermm versions prior to 37f2d24e51b04346dfc565b93fc2fc6b37bdaea9 Description A SQL injection issue exists in the file /chkuser.php due to manipulation of the Username argument. This allows for remote attacks. The exploit is...