CVE-2025-32312

CVE-2025-32312 affects Android’s PackageParser.java, specifically the function createIntentsList. Root cause: unsafe deserialization that bypasses lazy bundle hardening, allowing modified data to flow to the next process. Impact: local privilege escalation with no additional privileges required; ...

CVE-2025-32312

In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2025-23302

NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the LS10 could enable an attacker to set an unsafe debug access level. A successful exploit of this vulnerability might lead to denial of service...

CVE-2025-23301

NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the VBIOS could enable an attacker to set an unsafe debug access level. A successful exploit of this vulnerability might lead to denial of service...

CVE-2025-23302

NVIDIA HGX and DGX are affected by CVE-2025-23302 due to a LS10 misconfiguration that could enable an unsafe debug access level and cause denial of service. The official bulletin specifies remediation by updating LS10 to version 1.8.0 (affected versions prior to 1.7.1). Blackwell variants (HGX/DG...

CVE-2025-23301

NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the VBIOS could enable an attacker to set an unsafe debug access level. A successful exploit of this vulnerability might lead to denial of service...

CVE-2025-23301

The connected NVIDIA bulletin confirms CVE-2025-23301 affects NVIDIA HGX and DGX systems due to a misconfiguration in the VBIOS that could allow an attacker to set an unsafe debug access level, potentially causing a denial of service. Affected components/versions include VBIOS on Hopper HGX/DGX (...

Exploit for Deserialization of Untrusted Data in Microsoft

CVE-2025-53772 - IIS WebDeploy RCE Exploit This repository co...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper validation of user input in the dataAddonlayouts and dataAddonlayoutsexcept parameters at /apprain/developer/addons/update/commonresource. An attacker can execute arbitrary JavaScript code in the...

Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."

...

Usage of unsafe random function in form-data for choosing boundary

...

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.

...

CVE-2025-55472

SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of user-supplied input in the columns0data parameter, which is directly used in SQL queries without proper validation or parameterization...

PT-2025-36028

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: A flaw exists in createIntentsList of PackageParser.java that may allow bypassing lazy bundle hardening. This can permit modified data to be passed to the next process due to unsafe...

appRain CMF 跨站脚本漏洞

appRain CMF is a content management framework. A cross-site scripting vulnerability exists in appRain CMF due to improper validation of user-supplied input on the /appain/admin/config/electrical endpoint. An attacker could use this vulnerability to steal the victim's cookie-based authentication...

Important: ImageMagick

Issue Overview: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage in coders/png.c are unsafe and can overflow, leading to memory corruption. This issue has been...

PT-2025-36059

Name of the Vulnerable Software and Affected Versions: versions prior to 2025-48535 Description: A parcel mismatch in assertSafeToStartCustomActivity of AppRestrictionsFragment.java may lead to a launch anywhere vulnerability due to unsafe deserialization. This could result in local escalation of...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability due to an unsafe deserialization flaw in the assertSafeToStartCustomActivity function in AppRestrictions Fragment.java. An attacker can exploit the...

PT-2025-36046

Name of the Vulnerable Software and Affected Versions: BiometricEnrollIntroduction.java affected versions not specified Description: An issue exists in the onStart function of BiometricEnrollIntroduction.java related to an unsafe PendingIntent. This could allow an attacker to determine the device...

PT-2025-35951

Name of the Vulnerable Software and Affected Versions: NVIDIA HGX and DGX affected versions not specified Description: NVIDIA HGX and DGX systems are susceptible to a misconfiguration in the LS10 component, potentially allowing an attacker to establish an unsafe debug access level. Exploitation o...