xorg-x11-server: Use-after-free in ProcRenderAddGlyphs

A use-after-free vulnerability was found in the ProcRenderAddGlyphs function of Xorg servers. This issue occurs when AllocateGlyph is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently,...

CVE-2025-36606

Dell Unity, versions 5.5 and prior, contains an OS Command Injection Vulnerability in its svcnfssupport utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges...

CVE-2025-36607

Dell Unity, versions 5.5 and prior, contains an OS Command Injection Vulnerability in its svcnas utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges...

CVE-2025-36607

Dell Unity, versions 5.5 and prior, contains an OS Command Injection Vulnerability in its svcnas utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges...

CVE-2025-36607

Dell Unity, versions 5.5 and prior, contains an OS Command Injection Vulnerability in its svcnas utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges...

CVE-2025-36607

Dell Unity, versions 5.5 and prior, contain an OS Command Injection in the svc_nas utility. An authenticated attacker could escape the restricted shell and execute arbitrary OS commands with root privileges. Connected sources confirm the affected component and root cause, but do not provide a con...

CVE-2025-36607

Dell Unity, versions 5.5 and prior, contains an OS Command Injection Vulnerability in its svcnas utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges...

CVE-2025-36606

Dell Unity, versions 5.5 and prior, contains an OS Command Injection Vulnerability in its svcnfssupport utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges...

CVE-2025-36606

Dell Unity, versions 5.5 and prior, contains an OS Command Injection Vulnerability in its svcnfssupport utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges...

CVE-2025-7500

The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2025-6076

Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the...

PT-2025-31811 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions 5.5 and prior Description: Dell Unity versions 5.5 and prior contain an OS Command Injection vulnerability in the svc nfssupport utility. An authenticated attacker could potentially exploit this vulnerability to escape the...

PT-2025-31812 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions 5.5 and prior Description: Dell Unity’s svc nas utility contains an OS Command Injection issue. An authenticated attacker could potentially exploit this, escaping the restricted shell and executing arbitrary operating syst...

CVE-2025-41372

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in...

CVE-2025-41370

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb/html/view/acceso.php...

CVE-2025-41376

CRLF Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid//token/fwyfw%0d%0aCookie:%20POC'...

CVE-2025-41371

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in...

CVE-2025-41375

SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' parameter in '/index.php' endpoint...

CVE-2025-41373

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in...

CVE-2025-52203

A stored cross-site scripting XSS vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are...