2890 matches found
CVE-2025-13324
CVE-2025-13324 affects Mattermost server versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, and 10.12.x
CVE-2025-13324 Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation
Mattermost versions 10.11.x = 10.11.5, 11.0.x = 11.0.4, 10.12.x = 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy version 1 protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to...
SUSE CVE-2025-68258
In the Linux kernel, the following vulnerability has been resolved: comedi: multiq3: sanitize config options in multiq3attach Syzbot identified an issue 1 in multiq3attach that induces a task timeout due to open or COMEDIDEVCONFIG ioctl operations, specifically, in the case of multiq3 driver. Thi...
PT-2025-51854
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.5 Mattermost versions 11.0.x through 11.0.4 Mattermost versions 10.12.x through 10.12.2 Description The software does not invalidate invite tokens after they are used. This allows a malicious actor who...
CVE-2025-13324: Incorrect Authorization
Mattermost versions 10.11.x = 10.11.5, 11.0.x = 11.0.4, 10.12.x = 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy version 1 protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to...
kafka: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption
A flaw was found in Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM, which did not fully adhere to the requirements of RFC 5802. Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the...
EUVD-2025-203743
In the Linux kernel, the following vulnerability has been resolved: comedi: multiq3: sanitize config options in multiq3attach Syzbot identified an issue 1 in multiq3attach that induces a task timeout due to open or COMEDIDEVCONFIG ioctl operations, specifically, in the case of multiq3 driver. Thi...
CVE-2025-68258
In the Linux kernel, the following vulnerability has been resolved: comedi: multiq3: sanitize config options in multiq3attach Syzbot identified an issue 1 in multiq3attach that induces a task timeout due to open or COMEDIDEVCONFIG ioctl operations, specifically, in the case of multiq3 driver. Thi...
UBUNTU-CVE-2025-68258
In the Linux kernel, the following vulnerability has been resolved: comedi: multiq3: sanitize config options in multiq3attach Syzbot identified an issue 1 in multiq3attach that induces a task timeout due to open or COMEDIDEVCONFIG ioctl operations, specifically, in the case of multiq3 driver. Thi...
CVE-2025-68258
In the Linux kernel, the following vulnerability has been resolved: comedi: multiq3: sanitize config options in multiq3attach Syzbot identified an issue 1 in multiq3attach that induces a task timeout due to open or COMEDIDEVCONFIG ioctl operations, specifically, in the case of multiq3 driver. Thi...
CVE-2025-68258
CVE-2025-68258 is a Linux kernel vulnerability in the comedi driver, specifically multiq3_attach(), where crafted config options could cause long task timeouts. Syzbot observed that setting s->n_chan via it->options[2] could trigger repeated multiq3_encoder_reset() calls, delaying processin...
CVE-2025-68258 comedi: multiq3: sanitize config options in multiq3_attach()
In the Linux kernel, the following vulnerability has been resolved: comedi: multiq3: sanitize config options in multiq3attach Syzbot identified an issue 1 in multiq3attach that induces a task timeout due to open or COMEDIDEVCONFIG ioctl operations, specifically, in the case of multiq3 driver. Thi...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure due to LLVM optimizations that may transform constant-time implementations into non-constant-time code. An attacker can obtain sensitive information by exploiting timing discrepancies through side-channel analysis...
CVE-2025-63094
XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing attackers to access sensitive information via side-channel analysis of the data cache...
PT-2025-50363
Name of the Vulnerable Software and Affected Versions XiangShan Nanhu V2 XiangShan Kunmighu V3 Description The software uses speculative execution and indirect branch prediction, potentially allowing attackers to access sensitive information through side-channel analysis of the data cache...
Goodbye, dark Telegram: Blocks are pushing the underground out
Telegram has won over users worldwide, and cybercriminals are no exception. While the average user chooses a messaging app based on convenience, user experience and stability and perhaps, cool stickers, cybercriminals evaluate platforms through a different lens. When it comes to anonymity, privac...
XenServer Security Update for CVE-2025-62626
Severity: Medium Description of Problem A hardware issue has been identified in AMD Zen 5 CPU devices that may cause those CPUs to return a value of zero more frequently than statistically expected when asked to generate a random value. This may compromise e.g. cryptographic keys that are generat...
Improper Access Control
github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to insufficient validation of guest user permissions when adding channel members, which allows an attacker to add any team member to their private channels via the...
Improper Access Control
github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to insufficient validation of guest user permissions when accessing channel information, which allows an attacker to discover active public channels and their metadata via the...