CVE-2025-66026

CVE-2025-66026 is a reflected XSS in REDAXO CMS (pre-5.20.1) affecting the Mediapool view where args[types] is echoed into an info banner without escaping. The root cause is lack of HTML-escaping when rendering the value, allowing an authenticated user to trigger arbitrary JavaScript execution in...

Ubuntu: Security Advisory (USN-7885-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-66017

CVE-2025-66017 affects the CGGMP family (CGGMP21 and CGGMP24). The vulnerability arises from improper use of presignatures in specific configurations, allowing signature forgery or reduced security. Affected details indicate that in CGGMP21 <= 0.6.3 and CGGMP24

CVE-2025-66017 CGGMP21 presignatures can be used in the way that significantly reduces security

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing requires 3 preprocessing rounds, identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used in the way that significantly reduces...

CVE-2025-66017 CGGMP21 presignatures can be used in the way that significantly reduces security

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing requires 3 preprocessing rounds, identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used in the way that significantly reduces...

USN-7885-1 openjdk-21 vulnerabilities

Jinfeng Guo discovered that the Security component of OpenJDK 21 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. CVE-2025-53057 Darius Bohni discovered that the JAX...

RUSTSEC-2025-0128 CGGMP21 presignatures can be used in the way that significantly reduces security

This attack is against presignatures used in very specific context: Presignatures + HD wallets derivation: security level reduces to 85 bits \ Previously you could generate a presignature, and then choose a HD derivation path while issuing a partial signature via Presignature::setderivationpath,...

RUSTSEC-2025-0129 Missing check in ZK proof in CGGMP21 Threshold Signing Protocol

Vulnerability concerns a missing check in the ZK proof that enables an attack in which single malicious signer can reconstruct full private key. Patches cggmp21 v0.6.3 is a patch release that contains a fix that introduces this specific missing check. However, we recommend upgrading to cggmp24...

CVE-2025-11934

Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier on multiple platforms allows for downgrading the signature algorithm used. For example when a client sends ECDSA P521 as the supported signature algorithm the server previously...

CVE-2025-13445

CVE-2025-13445 affects Tenda AC21 16.03.08.16. The issue is a stack-based buffer overflow in the /goform/SetIpMacBind handling, caused by insufficient validation of the argument list. This enables remote execution of code on the device, with exploit publicly published. CVSS-based assessments indi...

TencentOS Server 4: cpp-httplib (TSSA-2025:0374)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0374 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-12766

An Insecure Direct Object Reference IDOR vulnerability in the Management Console of BlackBerry® AtHoc® OnPrem version 7.21 could allow an attacker to potentially gain unauthorized knowledge about other organizations hosted on the same Interactive Warning System IWS...

CVE-2025-12766

CVE-2025-12766 is a vulnerability in the Management Console of BlackBerry AtHoc (OnPrem) v7.21 where an insecure direct object reference (IDOR) could allow an attacker to gain unauthorized knowledge about other organizations hosted on the same Interactive Warning System (IWS). Affected component:...

BlackBerry AtHoc 安全漏洞

BlackBerry AtHoc is a crisis communications solution for federal, state and local governments, public safety and law enforcement agencies, and schools from BlackBerry Canada. A security vulnerability exists in BlackBerry AtHoc version 7.21, which stems from the presence of insecure direct object...

WordPress plugin Photonic Gallery & Lightbox for Flickr, SmugMug & Others 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host a personal blog site on a PHP and MySQL based...

Malicious code in hokage-21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4424e8404da671e20f58b1df67ed3e9a2f3923b9edf1b88ec65f8514ab92590 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in intan-21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145413e87eb213c1719ef2c0ce3646db1f406538656778d4e95014f39fe5f874 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155576 Malicious code in hafiz-21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d03e993367dfe530b2874b5df44687afa445850769c4fe6b4f8bd8787ad9258c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manda-21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 642de07dac424184be3333b4eb486fff6b8e3cb3e1cffa9af839ac710e0ab217 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rita-21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f298812b8fd1eadca820804d56357ba5f739476373ead16c6d38de114027b861 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...