CVE-2025-21484

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet...

CVE-2025-21488

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set...

CVE-2025-21487

CVE-2025-21487 concerns information disclosure in Qualcomm closed‑source components due to incorrect handling of RTP payload length when decoding packets. The root cause is a buffer length mismatch that can lead to over-read and leakage of information from the UE. The vulnerability is categorized...

CVE-2025-21484

CVE-2025-21484 is an information-disclosure issue described as a buffer over-read in the Qualcomm data-network stack, triggered when a User Equipment (UE) decodes and reassembles RTP fragments received over the network. Public descriptions consistently state that the vulnerability causes informat...

CVE-2025-21484 Buffer Over-read in Data Network Stack & Connectivity

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet...

Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms

U.S. prosecutors last week levied criminal hacking charges against 19-year-old U.K. national Thalha Jubair for allegedly being a core member of Scattered Spider , a prolific cybercrime group blamed for extorting at least $115 million in ransom payments from victims. The charges came as Jubair and...

USN-7766-1 linux-aws-6.8, linux-gcp-6.8 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - x86 architecture; - Compute Acceleration Framework; - Bus devices; - AM...

Remote Code Execution (RCE)

picklescan is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of pickle files in UnixSubprocessTransport.start, which allows an attacker to execute arbitrary code by providing a malicious pickle file...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that stems from a potential information disclosure during decoding and reassembling of fragments when the UE receives RTP packets...

PT-2025-39268

Name of the Vulnerable Software and Affected Versions UE affected versions not specified Description An information disclosure issue exists when a User Equipment UE receives an Real-time Transport Protocol RTP packet from the network and attempts to decode and reassemble fragments from that packe...

PT-2025-39149

Name of the Vulnerable Software and Affected Versions CleverControl versions prior to 11.5.1041.6 Description The software does not validate TLS server certificates during installation. The installer uses curl.exe --insecure to download and execute external components, allowing a man-in-the-middl...

ROS-20250923-42

Vulnerability of the cURL command line utility's implementation of HTTP "chaining" compression mechanisms is related to the following the possibility to perform an infinite number of steps of HTTP server responses decompression, which will lead to uncontrolled memory consumption. uncontrolled...

ROS-20250923-22

A vulnerability in the curl program is related to a state issue with parallel processing of multiple transactions, resulting in ignoring HSTS support. Exploitation of the vulnerability could allow an attacker acting remotely to execute a MitM attack Vulnerability in the implementation of HTTP...

RHEL 10 : kernel (RHSA-2025:16354)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:16354 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: usb: dwc3: gadget: check tha...

kernel: vsock: Fix transport_* TOCTOU

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport TOCTOU Transport assignment may race with module unload. Protect newtransport from becoming a stale pointer. This also takes care of an insecure call in vsockuselocaltransport; add a lockdep assert. BUG: unab...

kernel: vsock: Fix transport_* TOCTOU

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport TOCTOU Transport assignment may race with module unload. Protect newtransport from becoming a stale pointer. This also takes care of an insecure call in vsockuselocaltransport; add a lockdep assert. BUG: unab...

kernel: sunrpc: fix handling of server side tls alerts

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tlsalertrecv due to its assumption it can read data from the msg iterator's kvec.. kTLS implementation splits TLS non-da...

sslyze

It is an offensive tool for scanning SSL/TLS configurations. The primary target of this tool is the SSL/TLS configuration of a server, which can be analyzed to ensure it uses strong encryption settings and is not vulnerable to known TLS attacks. The tool can connect to a server to perform the...

CVE-2025-34192

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to 20.0.2140 macOS/Linux client deployments are built against OpenSSL 1.0.2h-fips released May 2016, which has been end-of-life since 2019 and is no longer supported by the OpenSSL...

CVE-2025-34199

Vasion Print Virtual Appliance Host (pre-22.0.1049) and Vasion Print Application (pre-20.0.2786) expose insecure TLS usage due to disabling verification. Specifically, the code disables CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER and uses environment variables (e.g., API_*_VERIFYSSL=false) ...