Cryptographic Binding Should Not Be Optional: A Formal-Methods Analysis of FIDO UAF Channel Binding

As a case study in cryptographic binding, we present a formal-methods analysis of the cryptographic channel binding mechanisms in the Fast IDentity Online FIDO Universal Authentication Framework UAF authentication protocol, which seeks to reduce the use of traditional passwords in favor of...

EUVD-2025-38341

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1, a malicious CVAT user with at least the User global role may create files in the root of the mounted file share, or overwrite existing files. If no file share is mounted, the...

CVE-2025-63585

OSSN Open Source Social Network 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter...

[SECURITY] Fedora 41 Update: chromium-142.0.7444.59-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 42 Update: chromium-142.0.7444.59-1.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

Conda Constructor 安全漏洞

Conda Constructor is a Conda open source tool for creating installers from conda packages. A security vulnerability exists in Conda Constructor 3.12.2 and earlier versions, which stems from the installation directory inheriting parent directory permissions, which could lead to modification...

CVE-2024-25621

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths /var/lib/containerd,...

CVE-2025-64163

DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. However, omission of protection for the dns:// protocol results in an SSRF vulnerability. This issue is fixed in version 2.10.15...

EUVD-2025-37957

Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishing JDBC connections to Oracle, resulting in a risk of JNDI injection Java Naming and Directory Interface injection. This issue is fixed in version 2.10.15...

Weseek Growi 跨站脚本漏洞

Weseek Growi is an open source wiki system that can be written in Markdown by the Japanese company Weseek. A cross-site scripting vulnerability exists in Weseek Growi versions prior to 7.2.10, which originates when a malicious user creates a page containing specially crafted content that could le...

Weblate 安全漏洞

Weblate is a Copyleft open source web-based free software continuous localization system. A security vulnerability exists in Weblate 5.14 and earlier versions, which stems from audit logs leaking project member IP addresses, potentially leading to information disclosure...

CVE-2025-63585

OSSN Open Source Social Network 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter...

CVE-2025-64458

creationtimestamp| type| source ---|---|--- 2025-11-05 14:33:40+00:00| seen| https://seclists.org/oss-sec/2025/q4/147 2025-11-05 16:48:18+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m4vivmdsys2h 2025-11-05 20:08:20+00:00| seen|...

CVE-2025-52565

creationtimestamp| type| source ---|---|--- 2025-11-05 08:57:06+00:00| seen| https://seclists.org/oss-sec/2025/q4/138 2025-11-05 10:35:36+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m4uu364gd32h 2025-11-05 14:59:52+00:00| seen|...

EUVD-2025-37922

OSSN Open Source Social Network 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter...

Open Source Social Network 安全漏洞

Open Source Social Network OSSN is a source social network engine from the Swiss OSSN team. A security vulnerability exists in Open Source Social Network OSSN version 8.6, which stems from an incorrect manipulation of the parameter timestamp in the file /action/rtcomments/status, which could lead...

Cursor 访问控制错误漏洞

Cursor is an AI code editor from Cursor open source. An access control error vulnerability exists in Cursor version 1.7.23 and earlier, which stems from a logic error that could cause a malicious agent to read protected sensitive files...

CVE-2025-63585

OSSN Open Source Social Network 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter...

CVE-2025-63585

OSSN Open Source Social Network 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter...

DWSurvey 安全漏洞

DWSurvey is a DWSurvey open source questionnaire system written in Java. A security vulnerability exists in DWSurvey version 6.14.0, which stems from improper access control and could lead to the deletion of additional questionnaires...