3451 matches found
CVE-2025-60691: Stack-based Buffer Overflow
A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers Firmware E1200v2.0.11.001us.tar.gz. The applycgi and blockcgi functions copy user-supplied input from the "url" CGI parameter into stack buffers v36, v29 using sprintf without bounds checking. Because these buffe...
CVE-2025-60692: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in the libshared.so library of Cisco Linksys E1200 v2 routers Firmware E1200v2.0.11.001us.tar.gz. The functions getmacfromip and getipfrommac use sscanf with overly permissive "%100s" format specifiers to parse entries from /proc/net/arp into...
CVE-2025-60694: Stack-based Buffer Overflow
A stack-based buffer overflow exists in the validatestaticroute function of the httpd binary on Linksys E1200 v2 routers Firmware E1200v2.0.11.001us.tar.gz. The function improperly concatenates user-supplied CGI parameters routeipaddr03, routenetmask03, routegateway03 into fixed-size buffers v6,...
CVE-2024-45301
Mintty is a terminal emulator for Cygwin, MSYS, and WSL. In versions 2.3.6 through 3.7.4, several escape sequences can cause the mintty process to access a file in a specific path. It is triggered by simply printing them out on bash. An attacker can specify an arbitrary network path, negotiate an...
CVE-2025-64167
Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack leading to JS execution when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead...
CVE-2025-64167
Combodo iTop, a web-based IT service management tool, is vulnerable to cross-site scripting (JS execution) in versions prior to 2.7.13 and 3.2.2 when editing a URL parameter. In these versions, the export.php endpoint was deprecated and export-v2.php is used instead; the issue stems from insuffic...
CVE-2025-64167 Combodo iTop vulnerable to reflected XSS in webservices/export.php
Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack leading to JS execution when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead...
EUVD-2025-50821
Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack leading to JS execution when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead...
ZITADEL 安全漏洞
ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the container and serverless era, open sourced by ZITADEL in Switzerland. A security vulnerability exists in ZITADEL versions 4.0.0-rc.1 through 4.6.2, which stems from the presence of insecur...
PT-2025-45612
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990507)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990507 advisory. In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035i2cmasterxfer In af9035i2cmasterxfer, msg ...
bind security update
32:9.11.36-16.6 - Address various spoofing attacks CVE-2025-40778 32:9.11.36-16.5 - Add support for max-records-per-type and max-types-per-name options RHEL-61936 - Support reading of new options also in named-checkconf -z, v2...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989507)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989507 advisory. In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035i2cmasterxfer In af9035i2cmasterxfer, msg ...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-989738)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989738 advisory. In the Linux kernel, the following vulnerability has been resolved: dmaengine: mvxorv2: Fix a resource leak in mvxorv2remove A clkprepareenable call in the probe is...
Security update for strongswan
This update for strongswan fixes the following issues: CVE-2025-62291: fixed buffer overflow when handling EAP-MSCHAPv2 failure requests bsc1251941 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively...
PT-2025-45649
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...
CVE-2025-62402: Execution with Unnecessary Privileges
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...
USN-7841-1 strongswan vulnerability
Xu Biang discovered that the strongSwan client incorrectly handled EAP-MSCHAPv2 failure requests. If a user or automated system were tricked into connecting to a malicious server, a remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service, or possibly...
