Linux kernel fs/jfs/xattr.c ea_get() Heap Buffer Overflow DoS

The vulnerability of the eaget function in the fs/jfs/xattr.c component of the Linux kernel involves reading data from beyond the allowable buffer size. Exploiting this vulnerability can allow an attacker to access confidential data and also cause service failures...

CVE-2025-59839

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for...

PT-2025-39514

Name of the Vulnerable Software and Affected Versions TweetThis Shortcode plugin for WordPress versions prior to 1.8.1 Description The TweetThis Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'tweetthis' shortcode. Insufficient input sanitization and outp...

CVE-2025-59839

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for...

CVE-2025-59839 Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for...

CVE-2025-59839

Summary (CVE-2025-59839): The Star Citizen Wiki EmbedVideo Extension (MediaWiki) versions 4.0.0 and earlier allowed adding arbitrary HTML attributes via wikitext, enabling stored XSS through non-reserved data attributes (e.g., data-iframeconfig). Evidence from multiple sources notes this XSS clas...

CVE-2025-59839 Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for...

CVE-2025-59839 Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for...

Extension Embed Video security vulnerabilities

Extension Embed Video is an embedded video software from Star Citizen Wiki Open Source. A security vulnerability exists in EmbedVideo Extension 4.0.0 and earlier versions, which stems from allowing arbitrary attributes to be added to HTML elements, potentially leading to stored cross-site scripti...

GHSA-4J5H-MVJ3-M48V Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes

Summary The EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. Details The attributes of an iframe are populated with the value of an unreserved data attribute data-iframeconfig that can be set via wikitext:...

SUSE-SU-2025:20754-1 Security update for aide

This update for aide fixes the following issues: - CVE-2025-54389: Fixed improper output neutralization bsc1247884 - CVE-2025-54409: Fixed null pointer dereference after reading incorrectly encoded xattr attributes from database bsc1247885...

PT-2025-43619

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue where sysfs attributes not applicable for Virtual Functions VFs are exposed. Specifically, VFs are unable to read the BMG PCIE CAP0x138340 register or...

xfs: do not propagate ENODATA disk errors into xattr code

...

Linux Distros Unpatched Vulnerability : CVE-2022-50346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ext4: init quota for 'old.inode' in 'ext4rename' Syzbot found the following issue: ext4parseparam: swantextraisize=128 ext4inodeinfoinit: swantextraisize=32...

PT-2025-46747

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the ext4 filesystem related to extended attribute xattr handling. Specifically, a race condition can occur during xattr updates, leading to an EA...

SUSE CVE-2023-53369

In the Linux kernel, the following vulnerability has been resolved: net: dcb: choose correct policy to parse DCBATTRBCN The dcbnlbcnsetcfg uses erroneous policy to parse tbDCBATTRBCN, which is introduced in commit 859ee3c43812 "DCB: Add support for DCB BCN". Please see the comment in below code...

SUSE SLED15: cups / cups-client / cups-config / cups-ddk / cups-devel / etc (SUSE-SU-2025:03261-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03261-1 advisory. - CVE-2024-47175: no validation of IPP attributes in ppdCreatePPDFromIPP2 when writing to a...

CVE-2023-53420

In the Linux kernel, the following vulnerability has been resolved: ntfs: Fix panic about slab-out-of-bounds caused by ntfslistxattr Here is a BUG report from syzbot: BUG: KASAN: slab-out-of-bounds in ntfslistea fs/ntfs3/xattr.c:191 inline BUG: KASAN: slab-out-of-bounds in ntfslistxattr+0x401/0x5...

CVE-2023-53369

In the Linux kernel, the following vulnerability has been resolved: net: dcb: choose correct policy to parse DCBATTRBCN The dcbnlbcnsetcfg uses erroneous policy to parse tbDCBATTRBCN, which is introduced in commit 859ee3c43812 "DCB: Add support for DCB BCN". Please see the comment in below code...

DEBIAN-CVE-2023-53420

In the Linux kernel, the following vulnerability has been resolved: ntfs: Fix panic about slab-out-of-bounds caused by ntfslistxattr Here is a BUG report from syzbot: BUG: KASAN: slab-out-of-bounds in ntfslistea fs/ntfs3/xattr.c:191 inline BUG: KASAN: slab-out-of-bounds in ntfslistxattr+0x401/0x5...