CVE-2023-54046

CVE-2023-54046 — Linux kernel crypto: essiv vulnerability Concrete details from connected sources show that the issue lies in the essiv implementation in the Linux kernel, where EBUSY was not handled consistently with EINPROGRESS, risking use-after-free of request data when backlogged requests ar...

CVE-2023-54046 crypto: essiv - Handle EBUSY correctly

In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of essiv may specify...

CVE-2023-54046 crypto: essiv - Handle EBUSY correctly

In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of essiv may specify...

CVE-2023-53991

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Disallow unallocated resources to be returned In the event that the topology requests resources that have not been created by the system because they are typically not represented in dpumdsscfg ^1, the resources in...

CVE-2023-53991 drm/msm/dpu: Disallow unallocated resources to be returned

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Disallow unallocated resources to be returned In the event that the topology requests resources that have not been created by the system because they are typically not represented in dpumdsscfg ^1, the resources in...

PT-2025-53354

Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentication bypass vulnerability in the webNewAcct.cgi script that allows unauthenticated attackers to create admin user accounts. Attackers can exploit the missing control check by sending crafted POST requests to create administrative account...

PT-2025-53106

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a memory leak in the ath9k High-Speed USB HIF USB driver, specifically within the ath9k hif usb dealloc tx urbs function. The issue stems from a failure to...

PT-2025-53044

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the crypto/essiv module. The essiv module incorrectly handles the EBUSY return value, potentially leading to a use-after-free condition when...

The vulnerability of the Splunk Enterprise platform for operational analysis, related to insufficient validation of incoming requests, allows a perpetrator to carry out an SSRF attack.

The vulnerability of the Splunk Enterprise platform for operational analysis is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack by sending a specially crafted HTTP request remotely...

PT-2025-53118

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue within the md/raid5 component. A double-free condition can occur during chunk-sized reads on disks with badblocks due to an unnecessary bio put call in...

PT-2025-53040

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel’s RDMA/siw component related to handling immediate work requests and flushing to the completion queue. An incorrect send queue element opcode during...

PT-2025-52949

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s wifi subsystem, specifically within the cfg80211 and OCB Operation Channel Binding components. The issue involves unnecessary requests to the driver o...

The vulnerability of the Splunk Enterprise platform for operational analysis lies in its improper handling of output data from registration logs. This allows attackers to poison, falsify, or conceal confidential data in these logs.

The vulnerability of the Splunk Enterprise platform for operational analysis is related to the improper processing of output data for registration logs. Exploiting this vulnerability allows a malicious actor to poison, falsify, or hide confidential data from log records using specially created HT...

PT-2025-53364

Name of the Vulnerable Software and Affected Versions Microhard Systems IPn4G version 1.1.0 Description The software contains an authentication bypass that allows authorized attackers to read, modify, or delete arbitrary files. The issue resides in the hidden system-editor.sh script. Attackers ca...

The vulnerability of the REST API interface of the Cisco Catalyst Center (formerly Cisco DNA Center) allows a attacker to execute arbitrary commands.

The vulnerability of the REST API interface of the Cisco Catalyst Center formerly Cisco DNA Center exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...

CVE-2025-68696

httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd...

UBUNTU-CVE-2025-68696

httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd...

CVE-2025-68696

httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd...

GHSA-9C54-GXH7-PPJC Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Summary The download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints AWS/GCP/Azure, as well as...

Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Summary The download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints AWS/GCP/Azure, as well as...