OESA-2025-1134 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication...

SUSE CVE-2023-49582

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APRUSESHMEMSHMGET=1 apr.h Users are...

Exposure of Data Element to Wrong Session

Overview Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session due to the shared instance used in field injection without a CDI scope. An attacker can manipulate request data, impersonate users, or access sensitive information by exploiting the leakage of...

PT-2025-23640

Name of the Vulnerable Software and Affected Versions Jupyter Core versions prior to 5.8.0 Description The issue affects Jupyter Core on Windows, where the shared %PROGRAMDATA% directory is searched for configuration files, potentially allowing users to create files that impact other users. This ...

PT-2025-45462

Уязвимость системы управления базами данных «Ред База Данных» связана с ошибками синхронизации при использовании общего ресурса. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании сервера...

CVE-2025-24973

Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker ...

CVE-2025-24973 Concorde not removing authentication tokens after logging out

Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker ...

CVE-2025-24973 Concorde not removing authentication tokens after logging out

Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker ...

CVE-2025-24973

CVE-2025-24973 (Concorde/Nexkey) affects Concorde versions prior to 12.25Q1.1. The root cause is an improper logout implementation where authentication credentials remain in cookies after logout, potentially allowing an attacker to steal tokens. Impact is severe if a user with admin privileges is...

CVE-2025-24973 Concorde not removing authentication tokens after logging out

Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker ...

Astra Linux – Vulnerability in APR

The lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users to read access to named shared memory segments, potentially exposing sensitive application data. This issue does not affect non-Unix platforms, or builds with APRUSESHMEMSHMGET=1 apr.h. Users...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fixed deadlock issues with SRQ async events. The xalock function for the SRQ table may be required in AEQ. Use xastoreirq/xaeraseirq to avoid deadlock...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: uiohvgeneric: Do not free decrypted memory. In CoCo VMs, it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail, resulting in an error and the shared memory being retained. Callers must ta...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Added a check for the srqmaxsge attribute. The maxsge attribute is provided by the user and is inserted and used unchecked. Therefore, ensure that the value does not exceed the maximum allowed value before using it...

Astra Linux – Vulnerability in Firefox, Thunderbird

Insufficient checks during the processing of graphics shared memory could lead to memory corruption. This vulnerability could be exploited by an attacker to perform a sandbox escape. This issue affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

PT-2025-6243 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions 12.109.0 through 2025.2.0-alpha.0 Description: Misskey is an open source, federated social media platform. A login token named token is stored in a cookie for authentication purposes in Bull Dashboard, but this remains...

PT-2025-6251 · Concorde · Concorde

Name of the Vulnerable Software and Affected Versions: Concorde versions prior to 12.25Q1.1 Description: The issue arises from an improper implementation of the logout process, causing authentication credentials to remain in cookies even after a user has explicitly logged out. This may allow an...

CVE-2025-1151

creationtimestamp| type| source ---|---|--- 2025-02-10 17:01:15+00:00| seen| https://infosec.exchange/users/cve/statuses/113980661739594795 2025-02-10 17:15:42+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhtnhttbln2n 2025-02-10 18:45:32+00:00| seen|...

GHSA-8R8P-7MGP-VF56

creationtimestamp| type| source ---|---|--- 2025-02-10 15:50:17+00:00| seen| https://infosec.exchange/users/cve/statuses/113980382711327196 2025-02-10 16:31:11+00:00| seen| https://infosec.exchange/users/cR0w/statuses/113980543498444388 2025-02-10 17:30:24+00:00| published-proof-of-concept|...

@rpldy/chunked-uploady (>=1.6.1-rc.0, <=1.9.0), @rpldy/retry-hooks (>=1.6.1-rc.0, <=1.9.0) +8 more potentially affected by CVE-2024-57082 via @rpldy/uploader (>=1.6.1-rc.0, <=1.9.0)

@rpldy/uploader NPM version =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.6.1-rc.0, =1.9.0 Source cves: CVE-2024-57082 Source advisory: GHSA-PC47-G7GV-4GPW...