February 25, 2025—KB5052094 (OS Builds 22621.4974 and 22631.4974) Preview

None None...

WordPress plugin Info Cards 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

Siemens SIMATIC Devices Linux Kernel Access of Uninitialized Pointer (CVE-2022-42895)

There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2capcore.c's l2capparseconfreq function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435 a732b4e62ba3157a2e This plugin onl...

CVE-2024-5174

creationtimestamp| type| source ---|---|--- 2025-02-24 16:17:15+00:00| seen| https://t.me/cvedetector/18794...

WordPress Info Cards plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Logan Cote Patchstack Alliance in WordPress Plugin Info Cards versions = 1.0.5...

PT-2025-8699 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A crash issue was identified, characterized as an UNKNOWN READ. The crash involves the ndpi strdup function, process ndpi collected info function, and node cleanup walker function...

PT-2025-7664 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the interceptor strncat function, process ndpi collected info, and node cleanup...

PT-2025-7665 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN WRITE. The crash state involves several functions: ndpi free flow data, ndpi flow free, and process ndpi...

CLSA-2025-1740075135 kernel: Fix of 4 CVEs

media: uvcvideo: Skip parsing frames of type UVCVSUNDEFINED in uvcparseformat CVE-2024-53104 - ALSA: 6fire: Release resources at card release CVE-2024-53239 - btrfs: fix information leak in btrfsioctllogicaltoino CVE-2024-35849 - btrfs: fix use-after-free when COWing tree bock and tracing is...

CVE-2024-27227

creationtimestamp| type| source ---|---|--- 2025-02-18 21:11:31+00:00| seen| Telegram/kgQkjtHgJyeVIS88btYKpmhwrfE1ZPfqNK6P5-yTTYjKwU...

PT-2025-7784 · Unknown +1 · Ddimageortext +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A stored XSS risk was identified in the drag-and-drop onto image ddimageortext question type, which required additional sanitizing. Recommendations: At the moment, there is no information...

PT-2025-7261 · Git +1 · Wavpack

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue is related to a crash type of Object-size. The crash state involves the functions unpack dsd samples and unpack samples worker thread. No information is available about the...

OESA-2025-1110 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: i3c: Use i3cdev-desc-info instead of calling i3cdevicegetinfo to avoid deadlock A deadlock may happen since the i3cmasterregister acquires &i3cbus-lock twice. Se...

OESA-2025-1111 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: i3c: Use i3cdev-desc-info instead of calling i3cdevicegetinfo to avoid deadlock A deadlock may happen since the i3cmasterregister acquires &i3cbus-lock twice. Se...

CLSA-2025-1739525795 kernel: Fix of 24 CVEs

media: uvcvideo: Skip parsing frames of type UVCVSUNDEFINED in uvcparseformat CVE-2024-53104 - wifi: ath9k: add range check for connrspepid in htcconnectservice CVE-2024-53156 - xsk: fix OOB map writes when deleting elements CVE-2024-56614 - hvsock: Initializing vsk-trans to NULL to prevent a...

CVE-2025-0998

creationtimestamp| type| source ---|---|--- 2025-02-12 19:07:27+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113992482587961618 2025-02-14 23:26:21+00:00| seen| https://bsky.app/profile/cti-news.bsky.social/post/3li6e2carvs2w 2025-02-15 01:30:42+00:00| seen|...

GHSA-3MVX-QW4R-FCQF

creationtimestamp| type| source ---|---|--- 2025-02-12 17:52:24+00:00| seen| https://infosec.exchange/users/cve/statuses/113992187494675681...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: uprobes: Fixed a kernel information leak via “uprobes” vma. xoladdvma: Maps the uninitialized page allocated by createxolarea into user space. On some architectures x86, this memory is readable even without VMREAD or VMEXEC;...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: hsr: avoid potential out-of-bound access in fillframeinfo syzbot is able to feed a packet with 14 bytes, pretending it is a vlan one. Since fillframeinfo is relying on skb-maclen already, extend the check to cover this case...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: i3c: Use i3cdev-desc-info instead of calling i3cdevicegetinfo to avoid deadlock. A deadlock may occur because i3cmasterregister acquires &i3cbus-lock twice. See the log below. Use i3cdev-desc-info instead of calling...