28029 matches found
CVE-2025-65965 Grype has a credential disclosure vulnerability in Grype JSON output
Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found in Grype, affecting versions 0.68.0 through 0.104.0. If registry credentials are defined and the output of grype is written using the --file or --output json= option, the registr...
golang: archive/tar: Unbounded allocation when parsing GNU sparse map
A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go...
FortiOS FortiProxy Improper Security Check
The vulnerability of the FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks is related to improper security checks for standard elements. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...
Fedora 42 : k9s (2025-fd56e115c0)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-fd56e115c0 advisory. Rebuild to fix several CVEs in golang std. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note th...
Fedora 43 : k9s (2025-30806907c2)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-30806907c2 advisory. Rebuild to fix several CVEs in golang std. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note th...
EUVD-2025-199101
Babylon's BIP322 signature implementation is not fully compliant to the spec...
GHSA-JQG8-M35Q-JH7J Apache Syncope's AES encryption stores hard-coded passwords in internal database
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained...
Grafana SCIM Unauthorized Access
The vulnerability of the SCIM implementation in the Grafana monitoring and observation platform is related to deficiencies in the privilege assignment mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the platform...
PT-2025-47918
Name of the Vulnerable Software and Affected Versions Apache Syncope versions prior to 3.0.15 Apache Syncope versions prior to 4.0.3 Description Apache Syncope, when configured to use AES encryption for storing user passwords in its internal database, utilizes a hard-coded default key. This allow...
golang: archive/tar: Unbounded allocation when parsing GNU sparse map
A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go...
TencentOS Server 4: java-11-konajdk (TSSA-2025:0273)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0273 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
lasso security update
An update is available for lasso. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The lasso packages provide the Lasso library that implements the Liberty Allian...
SUSE-SU-2025:4115-1 Security update for libxml2
This update for libxml2 fixes the following issues: - CVE-2025-9714: Fixed inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c bsc1249076 - CVE-2025-8732: Fixed infinite recursion in catalog parsing functions when processing malformed SGML catalog files bsc1247850...
Critical: Red Hat Security Advisory: lasso security update
An update for lasso is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...
A Fuzzy Logic-Based Cryptographic Framework for Real-Time Dynamic Key Generation for Enhanced Data Encryption
With the ever-growing demand for cybersecurity, static key encryption mechanisms are increasingly vulnerable to adversarial attacks due to their deterministic and non-adaptive nature. Brute-force attacks, key compromise, and unauthorized access have become highly common cyber threats. This resear...
Critical: lasso security update
The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages. Security Fixes: lasso: Type...
OESA-2025-2665 lasso security update
The package is a implements the Liberty Alliance Single Sign On standards library, includeing the SAML2 and SAML specifications. it provides bindings for multiple languages.and allows to handle the whole life-cycle of SAML based Federations. Security Fixes: A denial of service vulnerability exist...
EUVD-2025-176231
Malicious code in standard-barnard-quark-yildun npm...