29913 matches found
PT-2025-45546
Name of the Vulnerable Software and Affected Versions WP2Social Auto Publish versions through 2.4.7 Description The WP2Social Auto Publish plugin for WordPress is susceptible to Reflected Cross-Site Scripting via PostMessage due to inadequate input sanitization and output escaping. This allows...
Underflow in aes_key_unwrap function
The aeskeyunwrap function would panic if passed a ciphertext that was too short. In a debug build, it would panic due to a subtraction underflow. In a release build, it would use the small negative quantity to allocate a vector. Since the allocator expects an unsigned quantity, the negative value...
Cross-site Scripting (XSS)
Overview @nuxt/devtools is a Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of error messages on DevTools authentication page. An attacker can extract authentication tokens by tricking a user into interacting with maliciously crafted...
GHSA-9C5Q-W6GR-FXCQ MQTT does not validate hostnames
A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle MITM attack...
Prototype Pollution
@messageformat/runtime is vulnerable to Prototype Pollution. The vulnerability is due to insufficient validation of nested message keys during message data processing, which allows an attacker to inject arbitrary properties into the Object prototype and cause denial of service or unexpected...
CVE-2025-61084
MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing eve...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990447)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990447 advisory. In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between nbdallocconfig and module removal When nbd module is being removing,...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990545)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990545 advisory. In the Linux kernel, the following vulnerability has been resolved: net/usb: kalmia: Don't pass actlen in usbbulkmsg error path syzbot reported that actlen in...
CVE-2025-46784
The connected advisories confirm CVE-2025-46404, CVE-2025-46705, CVE-2025-46784 and CVE-2025-47151 affect the lasso library (Entr'ouvert Lasso / liblasso) used for Liberty/SAML processing. Descriptions show a mix of denial-of-service via malformed SAML responses causing memory depletion or crashe...
CVE-2025-46784
A denial of service vulnerability exists in the lassonodeinitfrommessagewithformat functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a memory depletion, resulting in denial of service. An attacker can send a malformed SAML response to trigger this vulnerabili...
DELMIA Apriso Missing Authorization Vulnerability (CVE-2025-6205)
The version of DELMIA Apriso installed on the remote host is Release 2020 through Release 2025. It is, therefore, affected by a missing authorization vulnerability CVE-2025-6205 that could allow an attacker to gain privileged access to the application. Exploitation can be achieved by sending...
CVE-2025-61084
MDaemon Mail Server 23.5.2 is described as validating SPF, DKIM, and DMARC using the From header content enclosed in angle brackets () during SMTP DATA. An attacker can craft a From header using multiple invisible Unicode thin spaces to display a spoofed sender while still passing validation, ena...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988953)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988953 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in tcpbpfsendmsg while sk msg is full If tcpbpfsendmsg is running while...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-989496)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989496 advisory. In the Linux kernel, the following vulnerability has been resolved: net/usb: kalmia: Don't pass actlen in usbbulkmsg error path syzbot reported that actlen in...
Unity Linux 20.1050e Security Update: kernel (UTSA-2025-990005)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990005 advisory. In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between nbdallocconfig and module removal When nbd module is being removing,...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989851)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989851 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check index msgid before read or write WHAT msgid is used as an array index and ...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988857)
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988857 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: fix connection leak There's a potential leak issue under following execution sequence :...
CVE-2025-54329
An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. The function used to send a multiple-payloads message including an SMS...
Microsoft Teams Bugs Let Attackers Impersonate Colleagues and Edit Messages Unnoticed
Cybersecurity researchers have disclosed details of four security flaws in Microsoft Teams that could have exposed users to serious impersonation and social engineering attacks. The vulnerabilities "allowed attackers to manipulate conversations, impersonate colleagues, and exploit notifications,"...