10896 matches found
CVE-2025-14920
A flaw was found in the Hugging Face Transformers library. The parsing of model files fails to validate user-supplied data, causing a deserialization of untrusted data. An attacker can exploit this issue by providing a malicious Perceiver model or convincing a user to visit a malicious page,...
CVE-2022-50720
In the Linux kernel, the following vulnerability has been resolved: x86/apic: Don't disable x2APIC if locked The APIC supports two modes, legacy APIC or xAPIC, and Extended APIC or x2APIC. X2APIC mode is mostly compatible with legacy APIC, but it disables the memory-mapped APIC interface in favor...
CVE-2023-54073
The CVE-2023-54073 issue is a Linux kernel vulnerability fixed by adding the invariant !tpm_amd_is_rng_defective() at the hwrng_unregister() call site inside tpm_chip_unregister(). The description and connected sources show a crash scenario linked to hwrng_unregister() being called during tpm_chi...
CVE-2023-54073 tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site
In the Linux kernel, the following vulnerability has been resolved: tpm: Add !tpmamdisrngdefective to the hwrngunregister call site The following crash was reported: 1950.279393 listdel corruption, ffff99560d485790-next is NULL 1950.279400 ------------ cut here ------------ 1950.279401 kernel BUG...
CVE-2022-50720
The CVE-2022-50720 entry concerns the Linux kernel x86 APIC handling: BIOS can lock APIC into x2APIC mode, and if the kernel attempts to disable x2APIC or revert to legacy APIC while locked, a GP fault can occur. The vulnerability is tied to the new MSR IA32_XAPIC_DISABLE_STATUS and the LEGACY_XA...
PT-2025-53071
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.2.8 1 Description The Linux kernel contained an issue within the TPM Trusted Platform Module subsystem. A crash could occur due to a missing invariant check during the unregistration of the hardware random numb...
PT-2025-53024
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to the Advanced Programmable Interrupt Controller APIC. The APIC supports legacy APIC xAPIC and Extended APIC x2APIC modes. A new feature allows...
GHSA-C67J-W6G6-Q2CM LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
Summary A serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data...
Security Bulletin: TSSC/IMC is affected to an Acceptance of Extraneous Untrusted Data With Trusted Data
Summary TSSC/IMC is affected to an Acceptance of Extraneous Untrusted Data With Trusted Data. A patch was released to update the bind package. Vulnerability Details CVEID:CVE-2025-40778 DESCRIPTION: Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an...
CLSA-2025-1766502382 keylime: Fix of CVE-2025-13609
CVE-2025-13609: enforce TPM identity immutability for agent UUIDs in registrar, add shared memory for multiprocess synchronization...
EUVD-2025-204738
An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate access to the initial startup of the container sets a property of "allowany" to allow any user with a valid and trusted client auth...
keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module TPM device but claiming an existing agent's unique identifier UUID. This action overwrites the legitimate agent's identity, enabling the...
keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module TPM device but claiming an existing agent's unique identifier UUID. This action overwrites the legitimate agent's identity, enabling the...
tpm2_checkquote Component Access
The vulnerability of the tpm2checkquote component in the Trusted Platform Module tools repository is related to incorrect data regarding changes. Exploiting this vulnerability can allow an attacker to gain access to protected information through specially crafted queries...
tpm2_checkquote Component Access
The vulnerability of the tpm2checkquote component in the Trusted Platform Module tools repository is related to errors in processing input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to protected information using a specially crafted PCR file th...
TEE SOC driver DoS
The vulnerability of the TEE SOC microprogramming software driver for AMD processors is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...
CVE-2025-66521
A stored cross-site scripting XSS vulnerability exists in pdfonline.foxit.com within the Trusted Certificates feature. A crafted payload can be injected as the certificate name, which is later rendered into the DOM without proper sanitization. As a result, the injected script executes each time t...
SUSE CVE-2025-68161
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.htmlSslConfiguration-attr-verifyHostName configuration attribut...
CVE-2025-66521
A stored cross-site scripting XSS vulnerability exists in pdfonline.foxit.com within the Trusted Certificates feature. A crafted payload can be injected as the certificate name, which is later rendered into the DOM without proper sanitization. As a result, the injected script executes each time t...
CVE-2025-66521
A stored cross-site scripting XSS vulnerability exists in pdfonline.foxit.com within the Trusted Certificates feature. A crafted payload can be injected as the certificate name, which is later rendered into the DOM without proper sanitization. As a result, the injected script executes each time t...