PT-2025-36294

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.16.0-rc5-mm-new-damon+ 93 Description The Linux kernel contains a flaw in mm/damon/ops-common.c where the damon migrate pages function attempts page migration even if the target node is invalid. This can occur...

Complaint Management System Cross-Site Request Forgery Vulnerability

Complaint Management System is a complaint management system. The Complaint Management System suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that a request is coming from a trusted user. An attacker could use this...

PT-2025-30953

Name of the Vulnerable Software and Affected Versions: tj-actions/branch-names versions 8.2.1 and below Description: A critical command injection vulnerability exists in the tj-actions/branch-names GitHub Action workflow. This flaw stems from inconsistent input sanitization and unescaped output,...

CVE-2015-10140

The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files...

TP-Link Archer C1200 vulnerable to clickjacking

Overview Archer C1200 provided by TP-Link Systems Inc. contains the following vulnerability. Clickjacking CWE-1021 - CVE-2025-6983 Daimon Kawashima reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a user...

CVE-2025-6018

A Local Privilege Escalation LPE vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules PAM. This flaw allows an unprivileged local attacker for example, a user logged in via SSH to obtain the elevated privileges normally reserved for a physically present,...

CVE-2025-6018 Pam-config: lpe from unprivileged to allow_active in pam

A Local Privilege Escalation LPE vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules PAM. This flaw allows an unprivileged local attacker for example, a user logged in via SSH to obtain the elevated privileges normally reserved for a physically present,...

CVE-2025-6018 Pam-config: lpe from unprivileged to allow_active in pam

A Local Privilege Escalation LPE vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules PAM. This flaw allows an unprivileged local attacker for example, a user logged in via SSH to obtain the elevated privileges normally reserved for a physically present,...

CVE-2025-6018

A Local Privilege Escalation LPE vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules PAM. This flaw allows an unprivileged local attacker for example, a user logged in via SSH to obtain the elevated privileges normally reserved for a physically present,...

CVE-2025-6235

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

SUSE-SU-2025:02475-1 Security update 4.3.16 for Multi-Linux Manager Server

This update fixes the following issues: cobbler: - Prevent crash during Cobbler startup on NFS environments bsc1240666 - Synchronize cobbler add and sync actions bsc1233371 - Exclude disabled profiles from buildiso gen bsc1230908 grafana-formula: - Version 4.3.0: Added SUSE Linux Enterprise Serve...

WordPress WP Post Hide Cross-Site Request Forgery Vulnerability

WordPress WP Post Hide is a plugin for controlling the visibility of WordPress posts, hiding the display of specific posts in different locations such as the home page, category pages, and search results pages. WordPress WP Post Hide suffers from a cross-site request forgery vulnerability, which...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with WebSphere Remote Server, are affected by a security bypass vulnerability (CVE-2024-56339)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are shipped with IBM WebSphere Remote Server. Information about a security vulnerability affecting IBM WebSphere Application Server and WebSphere Application Server Liberty has been published in a security bulletin...

“Encryption Backdoors and the Fourth Amendment”

Law journal article that looks at the DualECPRNG backdoor from a US constitutional perspective: Abstract : The National Security Agency NSA reportedly paid and pressured technology companies to trick their customers into using vulnerable encryption products. This Article examines whether any of...

HAX CMS application pages vulnerable to clickjacking

Summary All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites. PoC To replicate this vulnerability, load the target page in an iframe and observe the rendered content. Impact ...

CVE-2025-6235

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

CVE-2025-6235 ExtremeControl (NAC) 'onmouseover' XSS

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

CVE-2025-6235

CVE-2025-6235 affects ExtremeControl prior to 25.5.12, with an XSS in the login interface due to improper handling of user input in HTML attributes. The vulnerability can allow injected script to run in a user’s browser under certain interactions, potentially exposing user data or enabling unauth...

PT-2025-31594 · Github Actions · Buildalon/Setup-Steamcmd

Summary Log output includes authentication token that provides full account access Details The post job action prints the contents of config/config.vdf which holds the saved authentication token and can be used to sign in on another machine. This means any public use of this action leaves...

PT-2025-31593 · Github Actions · Rageagainstthepixel/Setup-Steamcmd

Summary Log output includes authentication token that provides full account access Details The post job action prints the contents of config/config.vdf which holds the saved authentication token and can be used to sign in on another machine. This means any public use of this action leaves...