CVE-2024-58136

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025. Recent assessments: chutton-r7 at May 11, 2025 1:58pm UTC reported: On the April 9 2025, Yii released an advisory...

Yii 安全漏洞

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. A security vulnerability exists in Yii 2 versions prior to 2.0.52, which stems from improper handling of behavior attachments...

Security update for expat

This update for expat fixes the following issues: CVE-2024-8176: Fixed denial of service from chaining a large number of entities caused by stack overflow by resolving use of recursion bsc1239618 Other fixes: - version update to 2.7.1 jscPED-12500 Bug fixes: 980 989 Restore event pointer behavior...

PT-2025-20479

Name of the Vulnerable Software and Affected Versions ASUS DriverHub versions prior to 1.0.6.0 Description An insufficient validation issue exists in ASUS DriverHub. This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints. The issue may allow...

PT-2025-28997

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains an issue where an uninitialized variable ret is used in the ecc-mxic functionality within the MTD/NAND subsystem. If ctx-steps is zero, the ECC step processin...

CVAD 2203- Services are failing intermittently after restart

After a database outage, restarting Citrix processes on the controllers, as well as rebooting the entire controller, results in crash notifications in event viewer and odd behavior...

CVE-2025-3416

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string...

CVE-2025-3416 Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string...

CVE-2025-3416

CVE-2025-3416 describes a Use-After-Free in rust-openssl used by OpenSSL for handling the properties argument, potentially causing undefined behavior or incorrect property parsing and treating input as an empty string. Connected advisories show this affects AWS Amazon Linux 2/AL2023 ecosystems vi...

CVE-2025-3416 Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string...

CVE-2025-31498 c-ares has a use-after-free in read_answers()

c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in readanswers when processanswer may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed...

tarteaucitron.js allows prototype pollution via custom text injection

A vulnerability was identified in tarteaucitron.js, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potenti...

CVE-2025-31475 tarteaucitron.js allows prototype pollution via custom text injection

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code ...

Don’t Miss Out: What You Need to Know Before Take Command 2025

Take Command 2025 is just two days away, and there’s still time to secure your spot. Whether you’ve already registered or are building your agenda now, there’s plenty to look forward to — and it all starts this Wednesday, April 9. In the lead-up to the live summit, two new on-demand sessions are...

PT-2025-15192 · Qualcomm · Snapdragon

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue involves memory corruption that occurs when invoking an IOCTL map buffer request from userspace. This can potentially lead to unintended system behavior. Recommendations: At the...

PT-2025-24556

Name of the Vulnerable Software and Affected Versions libarchive affected versions not specified Description A flaw has been identified in the libarchive library involving an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow,...

MAL-2025-3138 Malicious code in angular2-tesla-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 750e5a71820465f7842a06b6cbaa034cd7f4bf78fb9f20b44e5785088ae8b61a The OpenSSF Package Analysis project identified 'angular2-tesla-common' @ 99.99.103 npm as malicious. It is considered malicious because: - The...

MAL-2025-3136 Malicious code in clarunit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aecdc65ad87798f6243b3d284367e755b52beb5eef68fcc0ca08b0b802230643 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3132 Malicious code in internal-utils-bronxi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3b060b166dc77a08c11be2e3aae8d81e5f55f83f1838197b6332c9caf1ed3540 The OpenSSF Package Analysis project identified 'internal-utils-bronxi' @ 100.0.0 npm as malicious. It is considered malicious because: - The...

RUSTSEC-2025-0022 Use-After-Free in `Md::fetch` and `Cipher::fetch`

When a Some... value was passed to the properties argument of either of these functions, a use-after-free would result. In practice this would nearly always result in OpenSSL treating the properties as an empty string due to CString::drop's behavior. The maintainers thank quitbug for reporting th...