krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions

A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This ma...

Linux Distros Unpatched Vulnerability : CVE-2024-51491

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. The issue was identified during...

NASM Netwide Assember 安全漏洞

NASM Netwide Assember is an assembler and disassembler from the NASM team. A security vulnerability exists in NASM Netwide Assember version 2.17rc0, which stems from a post-release reuse issue in the function dodirective in the file preproc.c. The vulnerability is caused by the use of the functio...

Linux Distros Unpatched Vulnerability : CVE-2024-8372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a...

Linux Distros Unpatched Vulnerability : CVE-2024-56138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during...

Linux Distros Unpatched Vulnerability : CVE-2022-50165

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: wil6210: debugfs: fix uninitialized variable use in wilwritefilewmi Commit 7a4836560a61 changes simplewritetobuffer with memdupuser but it forgets to chan...

PMSoftware Simple Web Server 安全漏洞

PMSoftware Simple Web Server is a simple HTTP server application from PMSoftware open source. A security vulnerability exists in PMSoftware Simple Web Server version 2.2 rc2, which stems from improper handling of the Connection HTTP header and could lead to a stack buffer overflow and remote code...

Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.

...

PT-2025-34401

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.16.0-rc6-syzkaller-00002-g155a3c003e55 Description: The Linux kernel contained a flaw in the netfilter bpf Berkeley Packet Filter functionality. Specifically, the nf hook run bpf function did not disable...

MAL-2025-6015 Malicious code in rc-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5638d1bfc139a2ee01491c7afc44cf724fd4b1f7022fbf78bf9430a2cc3f236 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rc-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5638d1bfc139a2ee01491c7afc44cf724fd4b1f7022fbf78bf9430a2cc3f236 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XWiki 16.10.0-rc-1 < 16.10.4, 17.0.0-rc-1 < 17.1.0 RCE Vulnerability (GHSA-rhfv-688c-p6hp)

Xwiki is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

ZITADEL 安全漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the container and serverless era from the Swiss ZITADEL open source. A security vulnerability exists in ZITADEL versions 4.0.0-rc.2, 3.3.2, 2.71.13, and prior to 2.70.14, which stems from a la...

PT-2025-33558

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A race condition exists between the spsc queue push function and the run-job worker, potentially causing job scheduling to halt and leading to hangs while waiting on DMA fences. This...

CVE-2025-50183 OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer

OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in tags may be interpreted and executed as HTML in certain modes. Th...

CVE-2025-50183

OpenList Frontend (OpenList Frontend) prior to 4.0.0-rc.4 contains a stored Cross‑Site Scripting (XSS) in the file preview/browsing feature. Files with a .py extension that contain JavaScript wrapped in [removed] tags may be interpreted as HTML in certain modes, allowing script execution in the b...

CVE-2025-50183 OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer

OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in tags may be interpreted and executed as HTML in certain modes. Th...

USN-7542-1 krb5 vulnerability

It was discovered that Kerberos allowed the usage of weak cryptographic standards. An attacker could possibly use this issue to expose sensitive information. This update introduces the allowrc4 and allowdes3 configuration options, and disables the usage of RC4 and 3DES ciphers by default. Users a...

CVE-2024-24015

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL via /sys/user/exit...

CVE-2023-26470

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an object to a page with a huge number e.g. 67108863. Most of the time this will fill the memory allocated to XWiki and make it unusable every...