1780 matches found
Double Free
Overview nvidia-pytriton is a PyTriton - Flask/FastAPI-like interface to simplify Triton's deployment in Python environments. Affected versions of this package are vulnerable to Double Free via the cancellation handling for gRPC non-decoupled inference. An attacker can cause a double free by...
Ilevia EVE X1 Server 4.7.18.0.eden Neuro-Core Unauth Code Invasion
Summary EVE is a smart home and building automation solution designed for both residential and commercial environments, including malls, hotels, restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive control and monitoring of electrical installations through a highly...
IOHIDeous
IOHIDeous A macOS kernel exploit based on an IOHIDFamily 0day. Write-up here. Notice The prefetch timing attack I'm using for hid for some reason doesn't work on High Sierra 10.13.2 anymore, and I don't feel like investigating that. Maybe patched, maybe just the consequence of a random change, I...
CVE-2025-31512
An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval via isAddedByApprover in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater than one of the followin...
Alert Enterprise Guardian 安全漏洞
Alert Enterprise Guardian is a physical identity and access management system open-sourced by Alert Enterprise in the United States. A security vulnerability exists in Alert Enterprise Guardian version 4.1.14.2.2.1, which originates from elevation to administrator privileges via the IsAdminApprov...
PT-2025-30453 · Alertenterprise · Alertenterprise Guardian
Name of the Vulnerable Software and Affected Versions: AlertEnterprise Guardian version 4.1.14.2.2.1 Description: An issue allows for privilege escalation to administrator privileges via manipulation of the IsAdminApprover parameter within a Request Building Access request submitted through the...
CVE-2025-31511
An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval by changing the user ID in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater than one of the...
Alert Enterprise Guardian 安全漏洞
Alert Enterprise Guardian is a physical identity and access management system open-sourced by Alert Enterprise in the United States. A security vulnerability exists in Alert Enterprise Guardian version 4.1.14.2.2.1 that originates from bypassing manager approval by modifying the user ID in the...
Alert Enterprise Guardian 安全漏洞
Alert Enterprise Guardian is a physical identity and access management system open-sourced by Alert Enterprise in the United States. A security vulnerability exists in Alert Enterprise Guardian version 4.1.14.2.2.1 that originates from bypassing manager approval via isAddedByApprover in the...
CVE-2025-53923 Emlog vulnerable to reflected Cross-site Scripting in admin panel
Emlog is an open source website building system. A cross-site scripting XSS vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. Due to lack of sanitization it is possible to inject HTML/JS code into keywor...
CLSA-2025-1752238368 Update of gnutls
Fix timing side-channel in deterministic ECDSA RHEL-28958 - Fix potential crash during chain building/verification RHEL-28953...
AZL-70424 CVE-2025-38208 affecting package kernel 5.15.200.1-1
In the Linux kernel, the following vulnerability has been resolved: smb: client: add NULL check in automountfullpath page is checked for null in buildpathfromdentryoptionalprefix when tcon-originfullpath is not set. However, the check is missing when it is set. Add a check to prevent a potential...
Malicious code in frontend-building_blocks (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28828db7648dd2c99bf1bbda884e9f12b8f0a60ac0068a6c12e5ed0ce79cb651 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Moderate: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: net/http:...
ALSA-2025:9623 Moderate: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: net/http:...
[SECURITY] Fedora 42 Update: python-setuptools-74.1.3-7.fc42
Setuptools is a collection of enhancements to the Python distutils that allow you to more easily build and distribute Python packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptools, necessary to execute the software that...
Weak Password Storage Vulnerability in Various ABB Products
ABB ASPECT is a scalable building energy management and control solution.ABB MATRIX is an embedded building automation network controller.ABB NEXUS is a wireless and wired solution. A weak password storage vulnerability exists in several ABB products, which can be exploited by an attacker to caus...
Siemens APOGEE PXC+TALON TC Series Denial of Service Vulnerability
Siemens APOGEE PXC+TALON TC Series is a series of core controllers for building automation systems from Siemens Germany. A denial of service vulnerability exists in the Siemens APOGEE PXC+TALON TC Series, which can be exploited by an attacker to cause a denial of service due to an unsolicited...
CVE-2023-26137
All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n carriage return line feeds characters to end the HTTP response headers and...