CLSA-2025-1754043770 java-17-openjdk: Fix of 4 CVEs

Update to jdk-17.0.16+8 - CVE-2025-50106: fix 2D component vulnerability in Java SE allowing remote attackers to compromise the Java runtime via crafted input - CVE-2025-30749: fix 2D rendering vulnerability in Java SE that could lead to application crash or remote code execution -...

The vulnerability of the nf_flow_pppoe_proto() function in the netfilter component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the nfflowpppoeproto function in the netfilter component of the Linux operating system is related to the use of uninitialized resources. Exploiting this vulnerability could allow a attacker to cause a service failure...

CVE-2025-8204

A vulnerability classified as problematic was found in Comodo Dragon up to 134.0.6998.179. Affected by this vulnerability is an unknown functionality of the component HSTS Handler. The manipulation leads to security check for standard. The attack can be launched remotely. The complexity of an...

CVE-2025-8182 Tenda AC18 Samba smb.conf weak password

A vulnerability has been found in Tenda AC18 15.03.05.19 and classified as problematic. This vulnerability affects unknown code of the file /etcro/smb.conf of the component Samba. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an atta...

CVE-2025-8161

Affects deerwms deer-wms-2 up to version 3.3. The vulnerability is an SQL injection in the /system/role/export function, triggered by manipulating the params[dataScope] argument. Exploitation is possible remotely and has been publicly disclosed. Affected versions are listed as up to 3.3 (vulnerab...

CVE-2025-7910 D-Link DIR-513 Boa Webserver formSetWanNonLogin sprintf stack-based overflow

A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function sprintf of the file /goform/formSetWanNonLogin of the component Boa Webserver. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible to initiate the atta...

CVE-2025-7549

CVE-2025-7549 affects Tenda FH1201 (version 1.2.0.14(408)). The vulnerability resides in the frmL7ProtForm function of /goform/L7Prot, where improper validation of the input page parameter enables a stack-based buffer overflow. This can be triggered remotely and, per sources, the exploit has been...

CVE-2025-7464 osrg GoBGP rtr.go SplitRTR out-of-bounds

A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The...

PT-2025-28427 · Unknown · Phpgurukul Car Washing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Car Washing Management System version 1.0 Description: A critical issue was found in the PHPGurukul Car Washing Management System, affecting some unknown functionality of the file /admin/editcar-washpoint.php. The manipulation of t...

CVE-2025-7102 BoyunCMS Server.php sql injection

A vulnerability was found in BoyunCMS up to 1.4.20. It has been declared as critical. This vulnerability affects unknown code of the file application/update/controller/Server.php. The manipulation of the argument phone leads to sql injection. The attack can be initiated remotely. The exploit has...

CVE-2025-52492

The firmware of Paxton Paxton10 versions prior to 4.6 SR6 contains hard-coded credentials for the Twilio API within the rootfs.tar.gz file. A remote attacker who obtains a copy of this firmware can extract these credentials to gain unauthorized access to the associated Twilio account. This exposu...

CVE-2025-7060 Monitorr Installer mkdbajax.php input validation

A vulnerability was found in Monitorr up to 1.7.6m. It has been classified as problematic. This affects an unknown part of the file assets/config/installation/mkdbajax.php of the component Installer. The manipulation of the argument datadir leads to improper input validation. It is possible to...

CVE-2025-49592 n8n Login Flow has Open Redirect Vulnerability

n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to untrusted, attacker-controlled domains after logging in, by crafting malicious URLs with a misleading redirect query parameter. This may...

PT-2025-27002

Name of the Vulnerable Software and Affected Versions: Octo-STS versions prior to v0.5.3 Description: Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. The issue allows for unauthenticated Server-Side Request Forgery SSRF by abusing fields in OpenID Connect...

PT-2025-26284 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue was found in the system, affecting an unknown function of the file /pages/cat update.php. The manipulation of the ID argument leads to SQL injection. It is possibl...

Ubuntu: Security Advisory (USN-7582-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-6133 Projectworlds Life Insurance Management System insertagent.php sql injection

A vulnerability was found in Projectworlds Life Insurance Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /insertagent.php. The manipulation of the argument agentid leads to sql injection. The attack may be launched remotely. The...

Theoretically Unmasking Inference Attacks against LDP-Protected Clients in Federated Vision Models

Federated Learning enables collaborative learning among clients via a coordinating server while avoiding direct data sharing, offering a perceived solution to preserve privacy. However, recent studies on Membership Inference Attacks MIAs have challenged this notion, showing high success rates...

TencentOS Server 3: openssl (TSSA-2023:0014)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0014 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2025-0923

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 stores source code on the web server that could aid in further attacks against the system...