40100 matches found
OPENSUSE-SU-2025:20049-1 Security update for tiff
This update for tiff fixes the following issues: tiff was updated to 4.7.1: Software configuration changes: Define HAVEJPEGTURBODUALMODE812 and LERCSTATIC in tifconfig.h. CMake: define WORDSBIGENDIAN via tifconfig.h doc/CMakeLists.txt: remove useless cmakeminimumrequired CMake: fix build with...
PT-2025-47518
Name of the Vulnerable Software and Affected Versions Isar versions 0.11-rc1 through 0.11 Description Isar is a system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining the ISAR APT SNAPSHOT DATE variable alone does not correctly set the timestamp value for securit...
Isar 安全漏洞
Isar is a file generation script open-sourced by ilbers GmbH. A security vulnerability exists in Isar versions 0.11-rc1 and 0.11, which stems from the fact that a separate definition of ISARAPTSNAPSHOTDATE fails to set the correct timestamps for security distributions, resulting in missed securit...
Towards a Formal Verification of Secure Vehicle Software Updates
With the rise of software-defined vehicles SDVs, where software governs most vehicle functions alongside enhanced connectivity, the need for secure software updates has become increasingly critical. Software vulnerabilities can severely impact safety, the economy, and society. In response to this...
Mageia: Security Advisory (MGASA-2025-0305)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2025-34324
GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate...
CVE-2025-34324
GoSign Desktop
EUVD-2025-198033
GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate...
CVE-2025-12391 Restrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Update
The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleoptinoptout function in all versions up to, and including, 1.5.2. This makes it possible for unauthenticated attackers to opt in and out of tracki...
CVE-2025-12391
CVE-2025-12391 affects the Restrictions for BuddyPress plugin for WordPress (
CVE-2025-12406
The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the printAdminPage function. This makes it possible for unauthenticated attackers to update setting...
Vulnerabilities fixed in Google Chrome
Google has fixed vulnerabilities in Chrome Specifically for versions prior to 142.0.7444.175. The vulnerabilities are in Google Chrome's V8 engine and allow remote attackers to exploit heap corruption via specially crafted HTML pages, which can lead to unauthorized actions, such as access to...
CVE-2025-12406
CVE-2025-12406 concerns the WordPress plugin Project Honey Pot Spam Trap (versions
WordPress Cryptocurrency Payment Gateway for WooCommerce plugin <= 2.0.25 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Cryptocurrency Payment Gateway for WooCommerce versions = 2.0.25...
KLA90331 DoS vulnerabilities in Microsoft Browser
DoS vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to cause denial of service. Original advisories CVE-2025-13224 CVE-2025-13223 Exploitation Public exploits exist for this vulnerability. Related products Microsoft-Edge CVE list CVE-2025-13223...
PT-2025-47347
Name of the Vulnerable Software and Affected Versions Drupal versions 8.0.0 through 10.4.9 Drupal versions 10.5.0 through 10.5.6 Drupal versions 11.0.0 through 11.1.9 Drupal versions 11.2.0 through 11.2.8 Description A flaw exists in Drupal core related to the use of a web browser cache that can...
PT-2025-47302
Name of the Vulnerable Software and Affected Versions SourceCodester Train Station Ticketing System version 1.0 Description A SQL injection weakness exists in the Train Station Ticketing System. This issue is related to the manipulation of the Username argument within the login functionality,...
Mageia: Security Advisory (MGASA-2025-0300)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Oracle Linux 8 : container-tools:rhel8 (ELSA-2025-21232)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-21232 advisory. slirp4netns 1.2.3-1 - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.3 - Related: Jira:RHEL-2110 1.2.2-1 - update to...
A week in security (November 10 – November 16)
Last week on Malwarebytes Labs: Be careful responding to unexpected job interviews Your passport, now on your iPhone. Helpful or risky? 1 million victims, 17,500 fake sites: Google takes on toll-fee scammers Are you paying more than other people? NY cracks down on surveillance pricing We opened a...