CVE-2022-50410 NFSD: Protect against send buffer overflow in NFSv2 READ

In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This...

Security Bulletin: Sensitive Information Disclosure in IBM Lakehouse Through Stack Traces , affects watsonx.data

Summary IBM Lakehouse could potentially reveal sensitive information from stack traces that could be read by a local privileged user. This can affect watsonx.data. Vulnerability Details CVEID:CVE-2025-36146 DESCRIPTION: IBM Lakehouse could potentially reveal sensitive information from stack trace...

CVE-2023-53382

In the Linux kernel, the following vulnerability has been resolved: net/smc: Reset connection when trying to use SMCRv2 fails. We found a crash when using SMCRv2 with 2 Mellanox ConnectX-4. It can be reproduced by: - smcrun nginx - smcrun wrk -t 32 -c 500 -d 30 http://: BUG: kernel NULL pointer...

CVE-2023-53382 net/smc: Reset connection when trying to use SMCRv2 fails.

In the Linux kernel, the following vulnerability has been resolved: net/smc: Reset connection when trying to use SMCRv2 fails. We found a crash when using SMCRv2 with 2 Mellanox ConnectX-4. It can be reproduced by: - smcrun nginx - smcrun wrk -t 32 -c 500 -d 30 http://: BUG: kernel NULL pointer...

CVE-2023-53382 net/smc: Reset connection when trying to use SMCRv2 fails.

In the Linux kernel, the following vulnerability has been resolved: net/smc: Reset connection when trying to use SMCRv2 fails. We found a crash when using SMCRv2 with 2 Mellanox ConnectX-4. It can be reproduced by: - smcrun nginx - smcrun wrk -t 32 -c 500 -d 30 http://: BUG: kernel NULL pointer...

CVE-2025-0547

The CVE-2025-0547 entry concerns Paraşüt Bizmu (Bizmu) with XSS caused by improper neutralization of input during web page generation. Affected software: Bizmu versions 2.27.0 through 20250212. Root cause: inadequate input handling in web page generation that allows injection of malicious scripts...

PT-2025-38412

Name of the Vulnerable Software and Affected Versions IBM Lakehouse version 2.2 Description IBM Lakehouse watsonx.data 2.2 is susceptible to stored cross-site scripting. A privileged user can embed arbitrary JavaScript code within the Web UI, potentially altering functionality and leading to...

PT-2025-38415

Name of the Vulnerable Software and Affected Versions Smartvista BackOffice SmartVista Suite version 2.2.22 Description The software contains a Cross Site Request Forgery CSRF flaw. A crafted GET request can trigger the flaw. Recommendations Apply any available updates to address the issue in...

PT-2025-41191

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.45 Description A flaw exists within the Linker component of GNU Binutils 2.45, specifically in the bfd elf gc record vtentry function located in the bfd/elflink.c file. This issue allows for an out-of-bounds read. Local...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to properly handle the send buffer in the NFSv2 READ operation, which could result in a buffer...

SUSE CVE-2023-53364

In the Linux kernel, the following vulnerability has been resolved: regulator: da9063: better fix null deref with partial DT Two versions of the original patch were sent but V1 was merged instead of V2 due to a mistake. So update to V2. The advantage of V2 is that it completely avoids dereferenci...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the gRPC API and HTTP APIs, which allow peers to send requests that cause the recipient to create files in arbitrary file system locations and read arbitrary files. An attacker can access sensitive data or execu...

CVE-2025-59346

Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery SSRF vulnerability that enables users to force DragonFly2’s components to make requests to internal services that are otherwise not accessible to...

CVE-2025-59354 Dragonfly has weak integrity checks for downloaded files

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, including the MD5 hash, for downloaded files. This allows attackers to replace files with malicious ones that have a colliding hash. This...

CVE-2025-59348 Dragonfly incorrectly handles a task structure’s usedTraffic field

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the structure’s usedTraffic field, because an uninitialized variable n is used as a guard to the AddTraffic method call, instead of the...

CVE-2025-59348

CVE-2025-59348 affects Dragonfly, an open-source P2P file distribution and image acceleration system. The vulnerability lies in the processPieceFromSource method, where an uninitialized variable n is used as a guard for the AddTraffic call instead of the actual result.Size, causing the structure’...

Dragonfly's manager makes requests to external endpoints with disabled TLS authentication

Impact The Manager disables TLS certificate verification in two HTTP clients figures 3.1 and 3.2. The clients are not configurable, so users have no way to re-enable the verification. golang func getAuthTokenctx context.Context, header http.Header string, error skipped client := &http.Client...

CVE-2025-59345 Dragonfly did not enable authentication for some Manager’s endpoints

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create...

CVE-2025-10607

CVE-2025-10607 affects Portabilis i-Educar up to version 2.10, with an issue in an unknown function in /module/Avaliacao/diarioApi that can lead to information disclosure. Exploitation is possible remotely and has been publicly disclosed. Several connected sources (Red Hat, CVE records, OSV, CNNV...

CVE-2025-10606

CVE-2025-10606 affects Portabilis i-Educar up to 2.10, with a vulnerability in the file path /module/Configuracao/ConfiguracaoMovimentoGeral. The issue arises from manipulation of the argument tipoacao , enabling cross-site scripting (XSS). The description states that remote exploitation is possi...