[SECURITY] Fedora 43 Update: unbound-1.24.2-1.fc43

Unbound is a validating, recursive, and caching DNSSEC resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modula...

[SECURITY] Fedora 43 Update: drupal7-7.103-1.fc43

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

XML Injection

Overview fonttools is a Tools to manipulate font files Affected versions of this package are vulnerable to XML Injection via the main function in the fontTools/varLib/init.py file. An attacker can write files to the filesystem by supplying a specially crafted .designspace file. Remediation Upgrad...

The vulnerability of NVIDIA NeMo’s integrated platform for training and applying neural networks in speech processing and natural language processing lies in the fact that it allows unauthorized users to execute arbitrary code. This vulnerability stems from the inclusion of functions from an unverified and uncontrolled area.

The vulnerability of NVIDIA NeMo’s integrated platform for training and applying neural networks in speech processing and natural language processing lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow attackers to execute arbitra...

Prompt Injection Through Poetry

In a new paper, "Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models," researchers found that turning LLM prompts into poetry resulted in jailbreaking the models: Abstract : We present evidence that adversarial poetry functions as a universal single-turn...

OESA-2025-2749 golang security update

. Security Fixes: Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.CVE-2025-58187 The processing time for parsing some...

OESA-2025-2750 golang security update

. Security Fixes: Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.CVE-2025-58187 The processing time for parsing some...

go-rpm-macros security update

An update is available for go-rpm-macros. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This package provides build-stage rpm automation to simplify the creati...

RLSA-2025:22005 Moderate: go-rpm-macros security update

This package provides build-stage rpm automation to simplify the creation of Go language golang packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only. Security Fixes: os/exec: Unexpected paths returned from LookPath in os/exec...

RLSA-2023:2802 Moderate: container-tools:4.0 security and bug fix update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705 golang: go/parser: stack exhaustion in all Parse functions CVE-2022-1962 golang:...

container-tools:4.0 security and bug fix update

An update is available for cockpit-podman, module.libslirp, module.cockpit-podman, libslirp, criu, module.oci-seccomp-bpf-hook, oci-seccomp-bpf-hook, module.criu. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

container-tools:rhel8 security and bug fix update

An update is available for libslirp, module.libslirp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The container-tools module contains tools for working with...

CVE-2025-13770

CVE-2025-13770 affects WebITR by Uniong. A SQL Injection vulnerability allows authenticated remote attackers to inject arbitrary SQL and read database contents. The issue is documented with CVSS v3.1/4.0 bases (6.5 MEDIUM and 7.1 HIGH, respectively). Affected versions are not specified in the sou...

CVE-2025-13769

CVE-2025-13769 concerns WebITR by Uniong, with a SQL injection vulnerability that, when exploited by authenticated remote attackers, can read database contents. The included sources consistently describe the flaw as a SQL injection affecting WebITR; however, no concrete affected version list or v...

SUSE CVE-2025-64344

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected wh...

The vulnerability of the management tool for SNMP systems in centralized network device and port management solutions from Advantech iView allows a hacker to execute arbitrary code.

The vulnerability of the SNMP management tool for centralized network device and port management systems from Advantech iView relates to the lack of protection for the SQL query structure during the processing of the ztpsearchvalue parameter. Exploiting this vulnerability allows a malicious actor...

The vulnerability of the SNMP management tool for the centralized network device and port management system Advantech iView allows a hacker to disclose protected information.

The vulnerability of the SNMP management tool for the centralized network device and port management system Advantech iView is related to the lack of measures taken to protect the SQL query structure during parameter processing. Exploiting this vulnerability allows a malicious actor to disclose t...

The vulnerability of the NetworksController.addNetworkAction() function in software for remote monitoring with virtual private network capabilities, such as Advantech WebAccess/VPN, allows a intruder to gain access to database-related information.

The vulnerability of the NetworksController.addNetworkAction function in software for remote monitoring with virtual private networks like Advantech WebAccess/VPN is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow a malicious actor...

PT-2025-48320

Name of the Vulnerable Software and Affected Versions WebITR versions affected versions not specified Description WebITR developed by Uniong has a SQL Injection issue. Authenticated remote attackers can inject arbitrary SQL commands, potentially allowing them to read database contents. The...

The vulnerability of the management tool for SNMP systems in centralized network device and port management solutions from Advantech iView allows a hacker to execute arbitrary code.

The vulnerability of the SNMP management tool for centralized network device and port management systems from Advantech iView relates to the lack of measures taken to protect the SQL query structure during the processing of the searchterm parameter. Exploiting this vulnerability allows a maliciou...