Linux Distros Unpatched Vulnerability : CVE-2025-3628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. CVE-2025-3628 Note that...

CVE-2025-56254

CVE-2025-56254 affects PHPGurukul Employee Leave Management System 2.1 with an Insecure Direct Object Reference (IDOR) in the file leave-details.php . An authenticated user can alter the URL parameter leaveid to access leave application details of other users, exposing sensitive data. Multiple co...

CVE-2025-47171 Microsoft Outlook Remote Code Execution Vulnerability

...

CVE-2024-23329

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch//history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party...

Measuring the Accuracy and Effectiveness of PII Removal Services

This paper presents the first large-scale empirical study of commercial personally identifiable information PII removal systems -- commercial services that claim to improve privacy by automating the removal of PII from data broker's databases. Popular examples of such services include DeleteMe,...

Abusing with style: Leveraging cascading style sheets for evasion and tracking

Cisco Talos has identified actors abusing Cascading Style Sheets CSS to 1 evade spam filters and detection engines, and 2 track users' actions and preferences. This blog is a follow-up to our previous report on how threat actors could abuse CSS using a technique called "hidden text salting" to...

Discourse 安全漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as community, email, and chat rooms. Discourse suffers from a security vulnerability that stems from the fact that users may still be contacted under certain circumstances eve...

The vulnerability of the netfilter component in the Linux operating system’s kernel, which arises from the use of memory after deallocation, allows for interference with privacy, integrity, and accessibility.

The vulnerability of the netfilter component in the Linux operating system’s kernel relates to the ability to exploit memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise privacy, integrity, and accessibility...

Researcher Uncovers Flaws in Cox Modems, Potentially Impacting Millions

Now-patched authorization bypass issues impacting Cox modems could have been abused as a starting point to gain unauthorized access to the devices and run malicious commands. "This series of vulnerabilities demonstrated a way in which a fully external attacker with no prerequisites could've...

The vulnerability of the __unix_gc() function in the net/unix/garbage.c module of the Linux operating system allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the unixgc function in the net/unix/garbage.c module of the Linux operating system is related to concurrent access to resources race condition. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credential

Summary The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model, allowing a malicious holder of a revoked credential to generate a valid Non-Revocation Proof for that...

PT-2024-19012 · Ursa · Ursa

Name of the Vulnerable Software and Affected Versions: Ursa affected versions not specified Description: The revocation schema in Ursa's CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model. This flaw allows a...

PT-2024-19265 · Ursa · Ursa

Name of the Vulnerable Software and Affected Versions: Ursa affected versions not specified Description: The revocation scheme in Ursa's CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model. A malicious verifier may...

Mozilla: Potential exposure of uninitialized data in <code>EncryptingOutputStream</code>

The Mozilla Foundation Security Advisory describes this flaw as: EncryptingOutputStream was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have implications for private browsing mode...

Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`

Impact When using the Django integration of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry. These sensitive cookies could then be used by someone with access to your Sentry issues to impersonate or escalate their...

Mozilla: Reader mode bypassed SameSite cookies

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of requests initiated through the reader mode did not properly omit cookies with a SameSite attribute...

The vulnerability of the Java-Script script handler in Google Chrome browsers allows attackers to influence privacy, integrity, and accessibility.

The vulnerability of the Java-Script script handler in Google Chrome browsers relates to the use of memory after deallocation. Exploiting this vulnerability could allow an attacker to compromise privacy, integrity, and accessibility of data...

CVE-2021-30956

A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 15.2 and iPadOS 15.2. An attacker with physical access to a device may be able to see private contact information...

ALPINE-CVE-2020-6750

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxyaddr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays...

DEBIAN-CVE-2020-6750

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxyaddr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays...