Linux Distros Unpatched Vulnerability : CVE-2022-49823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ata: libata-transport: fix error handling in atatdevadd In atatdevadd, the return value of transportadddevice is not checked. As a result, it causes...

Insufficient Entropy

Overview thinbus-srp is a Secure Remote Password SRP SRP6a implementation. Affected versions of this package are vulnerable to Insufficient Entropy in the toHex function. An attacker can reduce the security margin of the protocol and potentially compromise session confidentiality by exploiting th...

SUSE CVE-2025-47281

Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service DoS vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft...

kernel: wifi: iwlwifi: limit printed string from FW file

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's the last TLV in the file, it can perha...

Linux Distros Unpatched Vulnerability : CVE-2025-37961

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipvs: fix uninit-value for saddr in dooutputroute4 syzbot reports for uninit-value for the saddr argument 1. commit 4754957f04f5 ipvs: do not use random local...

CVE-2025-54571 ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrate...

CVE-2025-54571 ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrate...

libcups:fuzzfile: Use-of-uninitialized-value in cups_write

Detailed Report: https://oss-fuzz.com/testcase?key=4912571816935424 Project: libcups Fuzzing Engine: libFuzzer Fuzz Target: fuzzfile Job Type: libfuzzermsanlibcups Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: cupswrite cupsFileClose fuzzfile.c Sanitizer:...

libcups:fuzzfile: Use-of-uninitialized-value in cups_write

Detailed Report: https://oss-fuzz.com/testcase?key=4730040270258176 Project: libcups Fuzzing Engine: libFuzzer Fuzz Target: fuzzfile Job Type: libfuzzermsanlibcups Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: cupswrite cupscompress cupsFileFlush Sanitizer:...

kernel: wifi: iwlwifi: limit printed string from FW file

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's the last TLV in the file, it can perha...

ffmpeg:ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer: Use-of-uninitialized-value in decode_frame

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5597015691296768 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDNOTCHLCfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

libxslt Key Data Storage Use-After-Free

libxslt suffers from a use-after-free vulnerability with key data stored cross-RVT...

Online Farm System categoryvalue.php File SQL Injection Vulnerability

Online Farm System is an online farm system. Online Farm System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Value in the file /categoryvalue.php. The vulnerability can be exploited by an attacker to...

firefox: thunderbird: JavaScript engine only wrote partial return value to stack

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: On 64-bit platforms, IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, reads the entire 64 bits...

firefox: thunderbird: JavaScript engine only wrote partial return value to stack

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: On 64-bit platforms, IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, reads the entire 64 bits...

CVE-2024-42644

FlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which occurs when the QoS value of the publish object is greater than 0...

ffmpeg:ffmpeg_AV_CODEC_ID_DXV_DEC_fuzzer: Use-of-uninitialized-value in dxt1_block_internal

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4521918634196992 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDDXVDECfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...

firefox: thunderbird: JavaScript engine only wrote partial return value to stack

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: On 64-bit platforms, IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, reads the entire 64 bits...

pcapplusplus:FuzzTargetNg: Use-of-uninitialized-value in pcpp::SSLLayer::parseNextLayer

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=5921566841176064 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTargetNg Job Type: libfuzzermsanpcapplusplus Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

code-projects Online Farm System 注入漏洞

Online Farm System is an online farm system. Online Farm System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Value in the file /categoryvalue.php. The vulnerability can be exploited by an attacker to...