RLSA-2025:3026 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: can: bcm: Fix UAF in bcmprocshow CVE-2023-52922 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to th...

kernel security update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

kernel security update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

The vulnerability of the squashfs_fill_super() function in the Squashfs component of Linux operating systems allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the squashfsfillsuper function in the Squashfs component of Linux operating systems is related to reading beyond the buffer boundaries of memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

Johnson Controls iSTAR Ultra 安全漏洞

Johnson Controls iSTAR Ultra is an access controller from Johnson Controls, Inc. It provides network resiliency and faster processing speeds. A security vulnerability exists in the Johnson Controls iSTAR Ultra that stems from the presence of OS command injection in the web application, which coul...

The vulnerability of the sub_4256CC() function in TP-Link TL-WPA8630 router software allows a hacker to execute arbitrary code.

The vulnerability of the sub4256CC function in TP-Link TL-WPA8630 router software lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the fb_cvt_hperiod() function in the fbdev component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the fbcvthperiod function in the fbdev component of the Linux operating system is related to the lack of checks for division by zero. Exploiting this vulnerability could allow an attacker to cause a service failure...

dag-factory 操作系统命令注入漏洞

dag-factory is an Astronomer open source by building Apache Airflow DAG. An operating system command injection vulnerability exists in dag-factory 0.23.0a8 and earlier versions, which stems from a misconfiguration of the cicd.yml workflow and could lead to arbitrary code execution...

CVE-2019-25224: Improper Neutralization of Special Elements used in an OS Command

The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system...

CVE-2025-29631: Improper Neutralization of Special Elements used in an OS Command

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an...

MB CONNECT LINE mbNET.mini Operating System Command Injection Vulnerability

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. MB CONNECT LINE mbNET.mini suffers from an operating system command injection vulnerability that stems from improper...

PT-2025-30720 · Databasebackup +1 · Wp Database Backup – Unlimited Database & Files Backup By Backup For Wp +1

The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system...

CVE-2025-40680

Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text within different registry keys on the Windows operating system. Any authenticated local user with read access to the registry can extract the...

CVE-2025-5243

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information...

CVE-2025-40680 Encryption of sensitive data in CapillaryScope missing

Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text within different registry keys on the Windows operating system. Any authenticated local user with read access to the registry can extract the...

The vulnerability of the OneDrive file sharing service for the macOS operating system arises from the insecure management of privileges, allowing an attacker to elevate their privileges to root user level.

The vulnerability of the OneDrive file sharing service for the macOS operating system is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root user level...

📄 Remote Mouse 3.303 Unauthenticated Remote System Control

Remote Mouse version 3.303 for macOS is vulnerable to unauthenticated remote power control due to weak access restrictions on UDP port 1978. An attacker on the same local network can send crafted packets to remotely shut down, restart, or log off the target system without requiring authentication...

The vulnerability of Cloudflare WARP VPN service for the macOS operating system, related to insecure privilege management. Exploiting this vulnerability can allow attackers to elevate their privileges to the root level.

The vulnerability of Cloudflare WARP VPN service for macOS relates to insecure management of privileges. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root level...

CVE-2025-24936

The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. An attacker with low privileged access to th...

CVE-2025-24938

The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access administrator to the application has the potential execute commands on the operating system under the context of the webserver. The vulnerable...