libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

...

Incorrect Authorization

Overview org.wso2.is:identity-server-parent is an open source Identity and Access Management solution federating and managing identities across both enterprise and cloud service environments. Affected versions of this package are vulnerable to Incorrect Authorization that allows an attacker in...

CVE-2025-21773 can: etas_es58x: fix potential NULL pointer dereference on udev->serial

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: fix potential NULL pointer dereference on udev-serial The driver assumed that es58xdev-udev-serial could never be NULL. While this is true on commercially available devices, an attacker could spoof the device...

PT-2025-8885 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A potential NULL pointer dereference issue was found in the Linux kernel, specifically in the etas es58x driver. The driver incorrectly assumed that es58x dev-udev-serial could never b...

Infoblox NIOS 访问控制错误漏洞

Infoblox NIOS is a system for managing and automating network devices and services from Infoblox, Inc. It is used to automate the configuration and management of networks and to ensure stable network operation. A security vulnerability exists in Infoblox NIOS version 8.6.4 and prior versions, whi...

WSO2 API Manager和WSO2 Identity Server 安全漏洞

WSO2 API Manager and WSO2 Identity Server IS are both products of WSO2, Inc.WSO2 API Manager is an API lifecycle management solution.WSO2 Identity Server is an identity server. A security vulnerability exists in WSO2 API Manager and WSO2 Identity Server that stems from improper authorization...

Infoblox NIOS 访问控制错误漏洞

Infoblox NIOS is a system for managing and automating network devices and services from Infoblox, Inc. It is used to automate the configuration and management of networks and to ensure stable network operation. A security vulnerability exists in Infoblox NIOS version 8.6.4 and prior versions, whi...

CVE-2022-49279

In the Linux kernel, the following vulnerability has been resolved: NFSD: prevent integer overflow on 32 bit systems On a 32 bit system, the "len sizeofp" operation can have an integer overflow...

DEBIAN-CVE-2022-49647

In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading csssets for migration Each cset cssset is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to...

UBUNTU-CVE-2022-49647

In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading csssets for migration Each cset cssset is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to...

CVE-2022-49647 cgroup: Use separate src/dst nodes when preloading css_sets for migration

In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading csssets for migration Each cset cssset is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to...

CVE-2022-49647 cgroup: Use separate src/dst nodes when preloading css_sets for migration

In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading csssets for migration Each cset cssset is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to...

CVE-2022-49647

CVE-2022-49647 affects the Linux kernel cgroups migration code. The vulnerability stems from overloading cset->mg_preload_node for both src and dst preload lists during task migrations, which could allow a cset to be simultaneously sourced and destined, risking a use-after-free if all tasks le...

Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019

The Cache Utility module provides an ability to view status and flush various caches. The module doesn't sufficiently protect against Cross Site Request Forgery CSRF attacks by validating user identity and intent when flushing a cache...

General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018

The GDPR Task submodule enables you to create GDPR tasks. The module doesn't sufficiently protect against Cross Site Request Forgery CSRF attacks by validating user identity and intent when creating tasks...

Tenable Identity Exposure 安全漏洞

Tenable Identity Exposure is a fast, agentless solution from Tenable, Inc. It can detect and block attacks, eliminate attack paths, and provide risk-based guidance on vulnerability management and remediation. A security vulnerability exists in Tenable Identity Exposure versions prior to 3.77.9,...

Tenable Identity Exposure 安全漏洞

Tenable Identity Exposure is a fast, agentless solution from Tenable, Inc. It can detect and block attacks, eliminate attack paths, and provide risk-based guidance on vulnerability management and remediation. A security vulnerability exists in Tenable Identity Exposure versions prior to 3.77.9,...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to perform cross-site scripting attacks.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2025-20059

Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through 5.10.3, through 2023.11.1, through 2024.9...

CVE-2024-49337

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to HTML injection, caused by improper validation of user-supplied input of text fields used to construct workflow email notifications. A remote authenticated attacker could exploit this vulnerability using HTML tags in a text field...