USN-7612-1 python-flask-cors vulnerabilities

It was discovered that Flask-CORS did not correctly handle certain regular expressions. A remote attacker could possibly use this issue to leak sensitive information or bypass authentication mechanisms. CVE-2024-6839 It was discovered that Flask-CORS allowed certain CORS headers to be enabled by...

CVE-2025-53006: Improper Neutralization of Substitution Characters

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference li...

CLSA-2025-1751133361 open-vm-tools: Fix of CVE-2025-22247

CVE-2025-22247: prevent usage of illegal characters in user names and file paths...

CVE-2025-52573 Command Injection in MCP Server ios-simulator-mcp

iOS Simulator MCP Server ios-simulator-mcp is a Model Context Protocol MCP server for interacting with iOS simulators. Versions prior to 1.3.3 are written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. T...

CVE-2025-52573

CVE-2025-52573 affects the iOS Simulator MCP Server (ios-simulator-mcp). The vulnerability arises in the MCP Server’s tool definitions (notably the ui_tap tool) which rely on Node.js child process API exec. When untrusted input is used for parameters such as duration, udid, x, and y, shell meta-c...

CVE-2025-2172

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames...

CLSA-2025-1750352922 git: Fix of CVE-2025-52005

CVE-2025-52005: add sideband.allowControlCharacters config which gives a possibility to avoid control characters in sideband - fix multiple memory leaks in config...

CLSA-2025-1750338301 git: Fix of CVE-2025-52005

CVE-2025-52005: add sideband.allowControlCharacters config which gives a possibility to avoid control characters in sideband - fix multiple memory leaks in config...

PT-2025-26171 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: open5gs versions 2.7.2 and earlier Description: A missing length check in the ogs pfcp subnet add function from the PFCP library allows a local attacker to cause a Buffer Overflow by changing the session.dnn field with a value with length...

Astra Linux – Vulnerability in Subversion

Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated users with commit access to commit a corrupted revision, resulting in disruptions for users of the repository. All versions of Subversion, including Subversi...

Astra Linux – Vulnerability in glibc

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single-byte and multibyte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer. This...

TencentOS Server 3: sudo (TSSA-2024:0063)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0063 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

openSUSE Security Advisory (SUSE-SU-2025:01952-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the userDate function. An attacker can inject arbitrary HTML into the DOM by editing interface messages that are rendered as raw HTML. This is only exploitable if a user has the editinterface right but not t...

Security update for python-Django

This update for python-Django fixes the following issues: CVE-2025-48432: log injection or forgery due to unescaped control characters being added into logs bsc1244095. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

CVE-2025-41234

A mishandling of non-ASCII characters in headers flaw was found in the Spring framework. This flaw allows an attacker to tamper with a file download under specific conditions when content names are user-supplied, and the victim then downloads unintended content. Mitigation Mitigation for this iss...

CLSA-2025-1749743573 git: Fix of CVE-2025-52005

CVE-2025-52005: add sideband.allowControlCharacters config which gives a possibility to avoid control characters in sideband...

Tenda AC9 注入漏洞

Tenda AC9 is a wireless router from Tenda, a Chinese company. The Tenda AC9 suffers from a command injection vulnerability that stems from the parameter list in the file /goform/SetIPTVCfg failing to properly filter constructed command special characters, commands, and so on. No details of the...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the title parameter in the URL /admin.php?m=config&n=edit&o=core&p=title. An attacker can inject malicious scripts from the admin interface by crafting a malicious title value. Note:...

Improper Handling of Invalid Use of Special Elements

Overview Affected versions of this package are vulnerable to Improper Handling of Invalid Use of Special Elements through the JDBC verification process. An attacker can manipulate MySQL queries by inserting special characters into JDBC URL and potentially access or modify data without proper...