Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Prevent the use of a lock before it is initialized. If a failure occurs during the probe of hfi1 before the sdmamaplock is initialized, the call to hfi1freedevdata will attempt to use a lock that has not been...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: dma-debug: fixed a possible deadlock in radixlock. The radixlock function should not be held while holding dmahashentryidx.lock. Otherwise, a deadlock scenario may occur when the dma debug API is called while holding rqlock...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in networking in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to bypass discretionary access control via malicious network traffic...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ublk: The SQE128 flag is validated before accessing the cmd field. The ublkctrlcmddump function accesses the sqe-cmd field before checking the IOURINGFSQE128 flag. This could lead to out-of-boundary memory access. The flag...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the handling of offloads in ipgre.c, there is a possibility of a page fault due to an invalid memory access. This could lead to the disclosure of local information without the need for additional execution privileges. User interaction is not required for exploitation. Product: Android Versions...

Astra Linux – Vulnerability in Intel Microcode

Hardware logic in some Intel processors may contain race conditions, which could allow an authenticated user to potentially enable partial information disclosure through local access...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Firmware: armffa – Set dmamask for FFA devices. Setting dmamask for FFA devices is necessary; otherwise, DMA allocation using the device pointer may lead to the following warning: WARNING: CPU: 1, PID: 1, at...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved by improving access restrictions to the file system. This issue is fixed in Safari 18.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, and visionOS 2.3. A maliciously crafted webpage may be able to obtain user fingerprints...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. The supported versions affected by this vulnerability are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1, and 22.0.0.2. This...

CVE-2022-0847

CVE-2022-0847 Linux “Dirty Pipe” consente a utenti non privilegiati di ottenere accesso root...

WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin RepairBuddy versions = 4.1223...

CVE-2026-46558

CVE-2026-46558 Il sottosistema asset V2 di Plane si fidava degli slug dei workspace e degli UUID degli asset senza imporre i necessari controlli di appartenenza, consentendo a un utente autenticato di leggere, copiare, eliminare e sovrascrivere asset in altri workspace. Introduzione Ho trovato...

CVE-2026-46552

CVE-2026-46552 I collegamenti di base condivisa di NocoDB potrebbero invitare membri reali della base e sopravvivere alla revoca della condivisione Introduzione Ho trovato questo problema mentre esaminavo NocoDB , con una semplice domanda di sicurezza in mente: Un link pubblico di base condivisa...

offensive-azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...

CVE-2026-33146

CVE-2026-33146 Una condivisione pubblica sembrava pulita nell'albero delle pagine, ma l'endpoint di ricerca raccontava un'altra storia. In Docmost, le pagine figlie con restrizioni nascoste ai visitatori della condivisione pubblica potevano comunque trapelare attraverso i risultati di ricerca del...

WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...

Vulnerabilities present in Atlassian products

Atlassian has hidden vulnerabilities in various products such as Bamboo, Bitbucket, Confluence, Jira, Crowd, and Fisheye. These vulnerabilities exist in various third-party products for which updates have already been released. Atlassian has incorporated these updates into its own products...

WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Booking and Rental Manager versions = 2.7.5...

CVE-2021-3064

CVE-2021-3064: Pan-OS Buffer Overflow Remoto + Contrabbando HTTP Exploit Questo exploit sfrutta una vulnerabilità di HTTP Smuggling per consegnare un payload a un endpoint altrimenti inaccessibile sui firewall Pan-OS; l'endpoint è vulnerabile a un overflow che può essere sfruttato per eseguire...

PoC-for-CVE-2025-9074

CVE-2025-9074 - PoC für nicht authentifizierten Zugriff auf die Docker-API 📌 Übersicht Dieses Repository stellt einen Proof-of-Concept-Exploit PoC für CVE-2025-9074 bereit, der die nicht authentifizierte Offenlegung der Docker-Engine-API auf TCP-Port 2375 betrifft. Ein Angreifer, der auf diese...