openSUSE 15 Security Update : python-maturin (SUSE-SU-2025:03082-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:03082-1 advisory. - CVE-2025-58160: terminal escape injection via ANSI sequences from untrusted input bsc1249011. Tenable has extracted the preceding description block direct...

SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2025:02423-2)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02423-2 advisory. - CVE-2021-25743: Escape terminal special characters in kubectl output bsc1194400. - CVE-2023-2431: Prevent pods to bypass the...

Wave Terminal 代码注入漏洞

Wave Terminal is an enterprise collaboration system from Wave Terminal open source. A code injection vulnerability exists in Wave Terminal version 0.12.2, which stems from Electron Fuses code injection and could lead to a TCC bypass...

curl: Terminal Output Not Great

Summary: No AI here, I just came across this: python import random import string from http.server import BaseHTTPRequestHandler, HTTPServer class MaliciousHandlerBaseHTTPRequestHandler: def doGETself: self.sendresponse200 self.sendheader'Content-Type', 'text/plain' randid =...

[SECURITY] Fedora 42 Update: timg-1.6.3-5.fc42

A user-friendly terminal image viewer that uses graphic capabilities of terminals Sixel, Kitty or iTerm2, or 24-bit color capabilities and Unicode character blocks if these are not available. On terminals that implement the Sixel protocol, the Kitty Graphics Protocol, or the iTerm2 Graphics...

Socomec DIRIS Digiware M-70 Denial of Service Vulnerability (CNVD-2025-30458)

The Socomec DIRIS Digiware M-70 is a communication gateway device that serves as an access point for the DIRIS Digiware system, which combines 24VDC power and communication functions in a single unit. A denial of service vulnerability exists in the Socomec DIRIS Digiware M-70 that stems from the...

Oracle Linux 10 : ELSA-2025-20145-0: / shadow-utils (ELSA-2025-201450)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-201450 advisory. 2:4.15.0-8 - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-93172 Tenable has extracted the preceding description block directly from...

CVE-2025-54848

A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted series of network requests can lead to a denial of service. An attacker can send a sequence of unauthenticated packets to trigger this...

CVE-2025-55222

CVE-2025-55222 affects Socomec DIRIS Digiware M-70 gateway (firmware 1.6.9). A DoS can be triggered by unauthenticated crafted Modbus TCP or Modbus RTU over TCP messages (USB Function), on port 503, causing device unresponsiveness. TALOS details confirm the vulnerability exists in Modbus TCP/RTU ...

Socomec DIRIS Digiware M-70 安全漏洞

The Socomec DIRIS Digiware M-70 is a communication gateway device that serves as an access point for the DIRIS Digiware system, which combines 24VDC power and communication functions in a single unit. A denial of service vulnerability exists in the Socomec DIRIS Digiware M-70, which stems from a...

Oracle Linux 9 : ELSA-2025-20559-0: / shadow-utils (ELSA-2025-205590)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-205590 advisory. 2:4.9-15 - nss.c: shadowlogfd to stderr. Resolves: RHEL-83431 - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-70844 and RHEL-72940...

tty: n_gsm: fix deadlock and link starvation in outgoing data path

...

runc: container escape with malicious config due to /dev/console mount and related races

A flaw was found in runc. CVE-2025-52565 is very similar in concept and application toCVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount to /dev/pts/$n, if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount...

The vulnerability of the SSH web terminal component of the Nagios XI monitoring infrastructure tool allows a hacker to execute arbitrary code and expose sensitive information.

The vulnerability of the SSH web terminal component of the Nagios XI monitoring infrastructure is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and expose sensitive information...

[SECURITY] Fedora 43 Update: gh-2.83.0-1.fc43

A command-line interface to GitHub for use in your terminal or your scripts. gh is a tool designed to enhance your workflow when working with GitHub. It provides a seamless way to interact with GitHub repositories and perform vari ous actions right from the command line, eliminating the need to...

EulerOS 2.0 SP10 : aide (EulerOS-SA-2025-2377)

According to the versions of the aide package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An...

runc: container escape with malicious config due to /dev/console mount and related races

A flaw was found in runc. CVE-2025-52565 is very similar in concept and application toCVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount to /dev/pts/$n, if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount...

CVE-2025-36131

IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows includes Db2 Connect Server clpplus command exposes user credentials to the terminal which could be obtained by a third party with physical access to the system...

EUVD-2025-38314

IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows includes Db2 Connect Server clpplus command exposes user credentials to the terminal which could be obtained by a third party with physical access to the system...

CVE-2025-36131

IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows includes Db2 Connect Server clpplus command exposes user credentials to the terminal which could be obtained by a third party with physical access to the system...