CVE-2025-13807 orionsec orion-ops API MachineKeyController.java MachineKeyController improper authorization

A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyController of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineKeyController.java of the component API. The manipulation result...

CVE-2025-13807 orionsec orion-ops API MachineKeyController.java MachineKeyController improper authorization

A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyController of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineKeyController.java of the component API. The manipulation result...

PT-2025-48412

Name of the Vulnerable Software and Affected Versions orionsec orion-ops versions up to 5925824997a3109651bbde07460958a7be249ed1 Description A flaw exists in orionsec orion-ops. The issue is related to improper authorization caused by manipulation of the ID argument within the update function...

orion-ops 安全漏洞

orion-ops is a one-stop automated O&M and automated deployment platform by the individual developer, Jiahang Li. A security vulnerability exists in orion-ops, which stems from the incorrect manipulation of the parameter ID in the file UserController.java, which could lead to improper authorizatio...

orion-ops 安全漏洞

orion-ops is a one-stop automated O&M and automated deployment platform by the individual developer, Jiahang Li. A security vulnerability exists in orion-ops, which stems from an incorrect operation of the file MachineKeyController.java, which could lead to improper authorization...

CVE-2025-13807: Improper Authorization

A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyController of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineKeyController.java of the component API. The manipulation result...

CVE-2025-13808: Improper Authorization

A flaw has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this vulnerability is the function update of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/UserController.java of the component User Profile Handler. This...

ASB-A-417987184

In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is...

CVE-2025-13809: Server-Side Request Forgery (SSRF)

A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown functionality of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineInfoController.java of the component SSH Connection...

PT-2025-48413

Name of the Vulnerable Software and Affected Versions orionsec orion-ops versions up to 5925824997a3109651bbde07460958a7be249ed1 Description A server-side request forgery condition exists in the SSH Connection Handler component of orionsec orion-ops. The issue is related to the manipulation of th...

orion-ops 安全漏洞

orion-ops is a one-stop automated operation and maintenance and automated deployment platform by Jiahang Li, an individual developer. A security vulnerability exists in orion-ops, which stems from the misuse of the parameters host/sshPort/username/password/authType in the file...

AWS VDP: Non-Production API Endpoints for the AI Ops Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration

The vulnerability found that there are 5 non-production endpoints for the AI Ops service that can be used with standard IAM credentials and do not log to CloudTrail. While the endpoints do not appear to provide access to customer partition data, they can be used for permission enumeration without...

BaoTa SQL注入漏洞

BaoTa is a Linux Ops panel by an individual developer at aapanel.com. A SQL injection vulnerability exists in BaoTa version 11.1.0 and earlier, which stems from incorrect manipulation of the parameter Name in the file /database?action=GetDatabaseAccess, which could lead to a SQL injection attack...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-989237)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989237 advisory. In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix use-after-free for dynamic ftraceops KASAN reported a use-after-free with ftrace ops ...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989572)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989572 advisory. In the Linux kernel, the following vulnerability has been resolved: rtnetlink: make sure to refresh masterdev/mops in rtnlnewlink While looking at one unrelated syzb...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Added freetransport operations in ksmbd connections. The freetransport function for TCP connections can be called from smdbdirect. This can cause a kernel error. This patch adds freetransport operations in ksmbd connection...

MAL-2025-49077 Malicious code in zeus-me-ops-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdb883ba3968557743369275e52574c356a37a380d7314c4fd45cc3ee6088a9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-36838

Malicious code in zeus-me-ops-tool npm...

CVE-2025-40079

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Sign extend struct ops return values properly The nsbpfqdisc selftest triggers a kernel panic: Unable to handle kernel paging request at virtual address ffffffffa38dbf58 Current testprogs pgtable: 4K pagesize, 57-bit...

CVE-2025-40041

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Sign-extend struct ops return values properly The nsbpfqdisc selftest triggers a kernel panic: Oops1: CPU 0 Unable to handle kernel paging request at virtual address 0000000000741d58, era == 90000000851b5ac0, ra =...