CVE-2025-4844

A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component CD Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the publi...

CVE-2025-4844 FreeFloat FTP Server CD Command buffer overflow

A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component CD Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the publi...

CVE-2025-4844 FreeFloat FTP Server CD Command buffer overflow

A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component CD Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the publi...

FreeFloat FTP Server 安全漏洞

FreeFloat FTP Server is an FTP service from Freefloat. A buffer overflow vulnerability exists in FreeFloat FTP Server, which stems from the component CD Command Handler failing to properly validate the length size of input data, no details of the vulnerability are provided at this time...

Witcher - Managing GitHub Advanced Security (GHAS) Controls At Scale

Implement and monitor Appsec control at scale. Requirements NodeJS 20.13 Tested on Mac Ubuntu How to install $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Build a Docker image $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ docker build -t witch...

CVE-2025-27365

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 Client connecting to a MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it...

PCMan FTP Server CD Command Buffer Overflow Vulnerability

PCMan FTP Server is a lightweight FTP server software that provides basic file transfer functionality. PCMan FTP Server suffers from a buffer overflow vulnerability that stems from the CD Command Handler component failing to properly validate input data when processing a specific request. An...

CVE-2025-32955 Harden-Runner Evasion of 'disable-sudo' policy

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Versions from 0.12.0 to before 2.12.0 are vulnerable to disable-sudo bypass. Harden-Runner includes a policy option disable-sudo to prevent the GitHub Actions runner user from using sudo. This is implemente...

Decoupling Identity from Access: Credential Broker Patterns for Secure CI/CD

Credential brokers offer a way to separate identity from access in CI/CD systems. This paper shows how verifiable identities issued at runtime, such as those from SPIFFE, can be used with brokers to enable short-lived, policy-driven credentials for pipelines and workloads. We walk through practic...

CVE-2025-22872 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-resizer, velero, crossplane-provider-aws-ec2, ip-masq-agent, lvm-driver, yq, amass, wave, kubernetes-csi-driver-hostpath, slsa-verifier, cloudnative-pg, crossplane-provider-azure, crossplane-provider-keycloak, dynamic-localpv-provisioner,...

CVE-2025-3726 PCMan FTP Server CD Command buffer overflow

A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component CD Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the publi...

CVE-2025-3726 PCMan FTP Server CD Command buffer overflow

A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component CD Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the publi...

CVE-2025-3726

CVE-2025-3726 affects PCMan FTP Server 2.0.7. The vulnerability lies in the CD Command Handler, where input data is not properly validated, causing a buffer overflow. The issue can be triggered remotely, and public exploitation has been disclosed. Several sources confirm the component-level root ...

Medium: python-pillow

Issue Overview: Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library PIL 1.1.7 and earlier allows remote attackers to cause a denial of service crash via a crafted PhotoCD file. CVE-2016-2533 Affected Packages: python-pillow Note: This...

Coinbase Initially Targeted in GitHub Actions Supply Chain Attack; 218 Repositories' CI/CD Secrets Exposed

The supply chain attack involving the GitHub Action "tj-actions/changed-files" started as a highly-targeted attack against one of Coinbase's open-source projects, before evolving into something more widespread in scope. "The payload was focused on exploiting the public CI/CD flow of one of their...

CVE-2025-29923 vulnerabilities

Vulnerabilities for packages: authservice, kots, atlantis, gitea, oauth2-proxy, fluent-bit-plugin-loki, splunk-otel-collector, falcosidekick...

GHSA-92CP-5422-2MW7 vulnerabilities

Vulnerabilities for packages: authservice, kots, atlantis, gitea, oauth2-proxy, fluent-bit-plugin-loki, splunk-otel-collector, falcosidekick...

CVE-2025-29923 vulnerabilities

Vulnerabilities for packages: gitea-fips, fluent-bit-plugin-loki, authservice, rekor-fips, argo-cd-fips, loki-fips, opentelemetry-collector-contrib-fips, falcosidekick, kots, loki, gitea, keda, mattermost-fips, dapr, splunk-otel-collector-fips, oauth2-proxy, atlantis, juicefs, falcosidekick-fips,...

GHSA-92CP-5422-2MW7 vulnerabilities

Vulnerabilities for packages: gitea-fips, fluent-bit-plugin-loki, authservice, rekor-fips, argo-cd-fips, loki-fips, opentelemetry-collector-contrib-fips, falcosidekick, kots, loki, gitea, keda, mattermost-fips, dapr, splunk-otel-collector-fips, oauth2-proxy, atlantis, juicefs, falcosidekick-fips,...

OESA-2025-1301 syslinux security update

The Syslinux Project covers lightweight bootloaders for MS-DOS FAT filesystems SYSLINUX, network booting PXELINUX, bootable "El Torito" CD-ROMs ISOLINUX, and Linux ext2/ext3/ext4 or btrfs filesystems EXTLINUX. The project also includes MEMDISK, a tool to boot legacy operating systems such as DOS...