[SECURITY] Fedora 41 Update: valkey-8.0.3-3.fc41

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from the failure to clean up the input value jid in the main pubret method, which could lead to a denial of servi...

Fedora: Security Advisory (FEDORA-2025-879f3d7695)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-4418 AVEVA PI Connector for CygNet Improper Validation of Integrity Check Value

An improper validation of integrity check value vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow a miscreant with elevated privileges to modify PI Connector for CygNet local data files cache and buffers in a way that causes the...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the /types/appendvalue.go component. When a placeholder is directly preceded by a minus - and not separated by any whitespace, the library does not handle the particular case when a negative number is inserted for the...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the /types/appendvalue.go component. When a placeholder is directly preceded by a minus - and not separated by any whitespace, the library does not handle the particular case when a negative number is inserted for the...

UBUNTU-CVE-2024-44905

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/appendvalue.go...

CVE-2025-44043

Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery SSRF in /KeyotiSearchEngineWebCommon/SearchService.svc/GetResults and /KeyotiSearchEngineWebCommon/SearchService.svc/GetLocationAndContentCategories. An attacker can specify their own SMB server as the indexDirectory...

OSV-2025-456 Use-of-uninitialized-value in ppd_hash_option

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=423674620 Crash type: Use-of-uninitialized-value Crash state: ppdhashoption cupsArrayFind ppdFindOption...

CVE-2025-4418: Improper Validation of Integrity Check Value

An improper validation of integrity check value vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow a miscreant with elevated privileges to modify PI Connector for CygNet local data files cache and buffers in a way that causes the...

PT-2025-36903

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=423674620 Crash type: Use-of-uninitialized-value Crash state: ppd hash option cupsArrayFind ppdFindOption...

EulerOS 2.0 SP11 : libarchive (EulerOS-SA-2025-1663)

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : listitemverbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or...

perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

A flaw was found in the FCGI library. In affected versions, specially crafted nameLen or valueLen values in data sent to the IPC socket may result in a heap-based buffer overflow, which can cause an application crash or other undefined behavior. This occurs in ReadParams in fcgiapp.c...

OSV-2025-454 Use-of-uninitialized-value in _cups_strcasecmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=423573723 Crash type: Use-of-uninitialized-value Crash state: cupsstrcasecmp ppdloadconstraints ppdConflicts...

PT-2025-36902

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=423573723 Crash type: Use-of-uninitialized-value Crash state: cups strcasecmp ppd load constraints ppdConflicts...

GHSA-68CF-J696-WVV9 GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx

Summary Missing checks allow for SSRF to specific targets using the TestWfsPost enpoint. Mitigation To manage the proxy base value as a system administrator, use the parameter PROXYBASEURL to provide a non-empty value that cannot be overridden by the user interface or incoming request.thomsmith...

freetype2:truetype-render-i35: Use-of-uninitialized-value in TT_Vary_Apply_Glyph_Deltas

Detailed Report: https://oss-fuzz.com/testcase?key=6393799112982528 Project: freetype2 Fuzzing Engine: libFuzzer Fuzz Target: truetype-render-i35 Job Type: libfuzzermsanfreetype2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: TTVaryApplyGlyphDeltas...

BIT-MARIADB-MIN-2021-46664

MariaDB through 10.5.9 allows an application crash in subselectpostjoinaggr for a NULL value of aggr...

cups:fuzz_ppd_gen_1: Use-of-uninitialized-value in ppd_hash_option

Detailed Report: https://oss-fuzz.com/testcase?key=5620661345386496 Project: cups Fuzzing Engine: libFuzzer Fuzz Target: fuzzppdgen1 Job Type: libfuzzermsancups Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: ppdhashoption cupsArrayFind ppdFindOption Sanitize...

cups:fuzz_ppd_gen_1: Use-of-uninitialized-value in _cups_strcasecmp

Detailed Report: https://oss-fuzz.com/testcase?key=5658185702899712 Project: cups Fuzzing Engine: libFuzzer Fuzz Target: fuzzppdgen1 Job Type: libfuzzermsancups Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: cupsstrcasecmp ppdloadconstraints ppdConflicts...