CVE-2025-54087

CVE-2025-54087 describes a server-side request forgery in Ivanti Secure Access prior to version 14.10. The vulnerability allows administrators to publish a crafted HTTP request originating from the Secure Access server, with attack complexity high, no required user interaction beyond administrati...

CVE-2025-11182

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allows Path Traversal.This issue affects ChangeFlow: All versions to v9.0.1.1...

$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

...

CVE-2025-11182 File Download in GTONE ChangeFlow

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allows Path Traversal.This issue affects ChangeFlow: All versions to v9.0.1.1...

CVE-2025-11182

The CVE-2025-11182 entry concerns GTONE ChangeFlow, where an improper pathname restriction (path traversal) combined with missing integrity checks on downloaded code exists in versions up to 9.0.1.1. Affected component: ChangeFlow download path handling; root cause: insufficient restriction of de...

CVE-2025-11182 File Download in GTONE ChangeFlow

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allows Path Traversal.This issue affects ChangeFlow: All versions to v9.0.1.1...

GTONE ChangeFlow 安全漏洞

GTONE ChangeFlow is an application change management software from GTONE Korea. A security vulnerability exists in GTONE ChangeFlow v9.0.1.1 and prior versions, which stems from improper pathname restriction and missing integrity checking of code downloads, which could lead to path traversal...

PT-2025-40423

Name of the Vulnerable Software and Affected Versions secure access versions prior to 14.10 Description This issue is a cross-site scripting condition. An attacker with administrative access to the console can disrupt another administrator's access. The attack complexity is low, and no specific...

PT-2025-40314

Name of the Vulnerable Software and Affected Versions GTONE ChangeFlow versions through 9.0.1.1 Description The software contains a flaw related to improper limitation of a pathname to a restricted directory, also known as 'Path Traversal', and allows for the download of code without integrity...

PT-2025-40421

Name of the Vulnerable Software and Affected Versions Secure Access versions prior to 14.10 Description A server-side request forgery condition exists in Secure Access. Individuals with administrative rights can submit a specially designed HTTP request from the Secure Access server. The attack...

CVE-2022-50428

CVE-2022-50428 affects the Linux kernel ext4 fast-commit journaling, caused by multiple off-by-one errors in filling tlv blocks. The issues constrain where tlvs start and end within a block, risking replay problems and memory leakage in last-byte handling. The fixed patch corrects block-filling o...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a lack of ktype integrity checking, which could lead to null pointer dereferencing...

Hitachi Energy MACH GWS

SUMMARY Hitachi Energy is aware of these vulnerabilities that affect the MACH GWS product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality, integrity and availability impacts. Please refer to the Recommended Immediate Actions...

Microsoft Windows inconsistent driver blocking

RISK EVALUATION Microsoft Windows Defender Application Control WDAC and the Microsoft vulnerable driver blocklist do not adequately block known-vulnerable drivers. These unexpected behaviors can confuse users about whether or not driver blocking is working and which drivers are being blocked. 2...

AMD Embedded Processors Security Update

AMD has informed HP of potential vulnerabilities in some AMD Embedded Processors and AMD Chipset Driver for the embedded processors, which might allow arbitrary code execution, denial of service, loss of integrity, loss of availability, or loss of confidentiality. AMD has released firmware and...

NewStart CGSL MAIN 6.06 : c-ares Vulnerability (NS-SA-2025-0226)

The remote NewStart CGSL host, running version MAIN 6.06, has c-ares packages installed that are affected by a vulnerability: - A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which...

Advisory ROSA-SA-2025-3012

software: opensc 0.26.1 OS: ROSA-CHROME unaffected versions = opensc-0.26.1-1 affected versions opensc-0.26.1-1 CVE-ID: CVE-2024-45615 BDU-ID: 2024-11086 CVE-Crit: LOW CVE-DESC.: A vulnerability in the pkcs15-init smart card personalization utility and the libopensc library of the OpenSC smart ca...

Ruckus Wireless ICX Switches Improper Validation of Integrity Check Value (CVE-2024-50604)

The following vulnerabilities are found in the RUCKUS FastIron firmware that runs on the RUCKUS ICX product line: - CVE-2024-50607: Directory traversal vulnerability - CVE-2024-50604: Insufficient validation for software component integrity check Collectively, these vulnerabilities can allow an...

The vulnerability of the amdgpu_dm_hdcp.c component in the Linux operating system allows a hacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the amdgpudmhdcp.c component in the Linux operating system is related to errors during the update of the link counters. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

ROS-20250929-13

Vulnerability in Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird email client is related to with an operation exceeding the memory buffer boundaries. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary code Vulnerability in JavaScript Engine...