1680 matches found
PT-2025-20264 · Cisco · Cisco Ios Xe
Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in the Internet Key Exchange version 1 IKEv1 implementation could allow an authenticated, remote attacker to cause a denial of service DoS condition. The...
Configure Proper Association Policies for INPUT and OUTPUT of nftables
Although you can configure protocols, IP addresses, and port numbers to add policies for packets entering and leaving a server to the INPUT and OUTPUT chains, it is difficult to configure suitable policies using the sport parameter due to complicated situations. For example, a client accesses the...
Microsoft announces the 2025 Security Excellence Awards winners
In today’s rapidly evolving digital world, security requires a global community of defenders working together as a team to build a safer world for all. That’s why we’re thrilled to recognize the extraordinary individuals and organizations who have gone above and beyond in the fight against...
SUSE CVE-2016-2131
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none...
CVE-2025-32816
CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity...
The vulnerability of the bond_ipsec_add_sa() function in the Linux operating system allows a hacker to trigger a service failure.
The vulnerability of the bondipsecaddsa function in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...
MAL-2025-2732 Malicious code in @johndeere-tech/helios-mat-styles (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 226a36baff3a45f171643849384a2b5ba6f9120f2a98d58b2589fc9381fc1c8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-13618 Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated SSRF
The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs...
CVE-2024-13617 Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Download
The aoa-downloadable WordPress plugin through 0.1.0 doesn't validate a parameter in its download function, allowing unauthenticated attackers to download arbitrary files from the server...
net/sctp: Prevent autoclose integer overflow in sctp_association_init()
...
CVE-2025-25461
A Stored Cross-Site Scripting XSS vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server an...
MAL-2025-1567 Malicious code in morganstanley.github.io (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da18628bae17a4b84b5818efb61d96bb37f0cddacea85240fbf4856ff0340353 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-25461
A Stored Cross-Site Scripting XSS vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server an...
CVE-2025-25461
CVE-2025-25461 affects SeedDMS 6.0.29. A stored XSS flaw exists in the category-name field: a user with Add Category permission can inject payloads that are stored server-side and rendered unencoded when a document is viewed, allowing execution in other users’ browsers. The root cause is lack of ...
The vulnerability of the sctp_association_init() function in the Linux operating system’s kernel allows a hacker to execute arbitrary code.
The vulnerability of the sctpassociationinit function in the Linux operating system’s kernel is related to integer overflow. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
kernel: xfrm: validate new SA's prefixlen using SA family when sel.family is unset
In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a "xfrm: Validate address prefix lengths in the xfrm selector." syzbot created an SA with...
CVE-2022-37660
In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the...
hostapd 安全漏洞
hostapd is a user space daemon for access points and authentication servers by the individual developer Jouni Malinen. A security vulnerability exists in hostapd version 2.10 and earlier, which stems from the PKEX code remaining active after successful association, making it vulnerable to attack...
CVE-2022-37660
In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the...
CVE-2022-37660
In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the...