HTMLParser quadratic complexity when processing malformed inputs

...

CVE-2025-49830

Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy yaml parser to reference files on the Secrets Manager, Self-Hosted server. These references may be used as reconnaissance to better understand th...

Security update for python311

This update for python311 fixes the following issues: CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser bsc1244705. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Vulnerabilities fixed in XWiki

XWiki has fixed vulnerabilities in the rendering system and the default macro content parser. The vulnerabilities in the XWiki rendering system allowed attackers to perform XSS attacks due to the dependency on the xdom+xml/current syntax. This vulnerability has been fixed in version 14.10. In...

Security update for ffmpeg

This update for ffmpeg fixes the following issues: CVE-2022-1475: Fixed integer overflow in g729parse in llibavcodec/g729parser.c bsc1198898. CVE-2024-36616: Fixed integer overflow in the component libavformat/westwoodvqa.c bsc1234018. CVE-2024-36617: Fixed integer overflow vulnerability in the...

SUSE-SU-2025:02352-1 Security update for ffmpeg

This update for ffmpeg fixes the following issues: - CVE-2022-1475: Fixed integer overflow in g729parse in llibavcodec/g729parser.c bsc1198898. - CVE-2024-36616: Fixed integer overflow in the component libavformat/westwoodvqa.c bsc1234018. - CVE-2024-36617: Fixed integer overflow vulnerability in...

aiohttp < 3.12.14 HTTP Request Smuggling Vulnerability - Windows

aiohttp is prone to an HTTP request smuggling vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2025-53836

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro content parser doesn't preserve the restricte...

Security update for rmt-server

This update for rmt-server fixes the following issues: Update to version 2.23 CVE-2025-46727: Fixed Unbounded-Parameter DoS in Rack:QueryParser. bsc1242893 CVE-2025-32441: Fixed a bug where simultaneous rack requests can restore a deleted rack session. bsc1242898 Patch Instructions: To install th...

CVE-2025-7673

A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50ABOM.5C0 could allow an unauthenticated attacker to cause denial-of-service DoS conditions and potentially execute arbitrary code by sending a specially crafted HTTP...

CVE-2025-7673

A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50ABOM.5C0 could allow an unauthenticated attacker to cause denial-of-service DoS conditions and potentially execute arbitrary code by sending a specially crafted HTTP...

CVE-2025-7673

CVE-2025-7673 affects Zyxel VMG8825-T50K with firmware versions prior to V5.50(ABOM.5)C0. A buffer overflow in the URL parser of the zhttpd web server could be triggered by a specially crafted HTTP request, allowing an unauthenticated attacker to cause a denial-of-service condition and potentiall...

Remote Code Execution (RCE)

org.xwiki.rendering:xwiki-rendering-transformation-macro is vulnerable to Remote Code Execution RCE. The vulnerability is due to the macro content parser failing to preserve the restricted attribute in the transformation context, allowing execution of normally forbidden macros like script macros ...

Azure Linux 3.0 Security Update: gdk-pixbuf2 (CVE-2025-6199)

The version of gdk-pixbuf2 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-6199 advisory. - A flaw was found in the GIF parser of GdkPixbuf's LZW decoder. When an invalid symbol is encountered...

SUSE CVE-2025-53643

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed i.e. without the...

CVE-2025-49830

Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy yaml parser to reference files on the Secrets Manager, Self-Hosted server. These references may be used as reconnaissance to better understand th...

CVE-2025-49830 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to path traversal and file disclosure

Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy yaml parser to reference files on the Secrets Manager, Self-Hosted server. These references may be used as reconnaissance to better understand th...

CVE-2025-49830

Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) are affected by CVE-2025-49830 due to a policy YAML parser that can reference server files, enabling information disclosure. Affected versions: Secrets Manager, Self-Hosted prior to 13.5.1 and 13.6.1; Conjur OSS prior to 1.2...

Malicious code in parser-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f76c3bdd99ca88025a5db8d68b9d2af5c7cada21d80042f568ea821e9c22b8ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5946 Malicious code in parser-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f76c3bdd99ca88025a5db8d68b9d2af5c7cada21d80042f568ea821e9c22b8ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...