Hubble 注入漏洞

Hubble is a Cilium open source network, service that uses eBPF to implement Kubernetes. An injection vulnerability exists in Hubble versions prior to 1.17.2, which stems from the possibility that a cyber attacker could inject malicious control characters to affect the integrity of endpoint output...

CVE-2025-48056: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Hubble is a fully distributed networking and security observability platform for cloud native workloads. Prior to version 1.17.2, a network attacker could inject malicious control characters into Hubble CLI terminal output, potentially leading to loss of integrity and manipulation of the output...

TOTOLINK CA600-PoE CloudSrvUserdataVersionCheck function version parameter command injection vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the CloudSrvUserdataVersionCheck function version parameter failing to correctly filter the constructor command special...

firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack...

TOTOLINK A3002R 安全漏洞

TOTOLINK A3002R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3002R suffers from a command injection vulnerability that stems from the FUN00459fdc function failing to properly filter constructed command special characters, commands, etc. The vulnerability can be...

OPENSUSE-SU-2025:0153-1 Security update for git-lfs

This update for git-lfs fixes the following issues: Update to 3.6.1: boo1235876: This release introduces a security fix for all platforms, which has been assigned CVE-2024-53263. When requesting credentials from Git for a remote host, prior versions of Git LFS passed portions of the host's URL to...

Radware Cloud Web Application Firewall 安全漏洞

Radware Cloud Web Application Firewall is a cloud-based web application firewall from Radware Israel. A security vulnerability exists in versions of Radware Cloud Web Application Firewall prior to 2025-05-07, which stems from the addition of special characters to a request may bypass firewall...

CLSA-2025-1746653856 ruby: Fix of 2 CVEs

upgrade rexml version to 3.3.3 - CVE-2024-41946: fix DoS vulnerability when parsing many entity expansions with SAX2 or pull parser API - CVE-2024-41123: fix DoS vulnerability when parsing XML with specific characters...

Ensure That the Password Complexity Is Set Correctly

Simple passwords, including short passwords and passwords containing only digits or letters, are easy to guess by brute force cracking tools. As such, users are required to set complex passwords. For service scenarios with high security requirements, follow industry best practices. For example,...

Ensure That Passwords Do Not Contain User Names

To ensure user security, you must configure passwords that do not contain user names. If a password is the same as the user name or the user name in reverse order, or contains the user name, attackers can guess the password easily. This requirement is not exerted on passwords of users whose names...

rexml: rubygem-rexml: DoS when parsing an XML having many specific characters such as whitespace character, >] and ]>

A vulnerability was found in REXML, an XML toolkit used for Ruby. When parsing an untrusted XML with many specific characters, the REXML gem may take a long time, leading to a denial of service condition. Some of these special characters include the whitespace character, '', and ''...

TOTOLINK CPE CP900 安全漏洞

TOTOLINK CPE CP900 is an outdoor wireless CPE device from China Gion Electronics TOTOLINK. The TOTOLINK CPE CP900 suffers from a command injection vulnerability that stems from the setUploadUserData function failing to properly filter construct command special characters, commands, etc. No detail...

CVE-2025-27611 base-x homograph attack allows Unicode lookalike characters to bypass validation.

base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions...

CVE-2025-27611 base-x homograph attack allows Unicode lookalike characters to bypass validation.

base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions...

Homograph attack allows Unicode lookalike characters to bypass validation.

Impact Attackers can deceive users into sending funds to an unintended address. Patches https://github.com/cryptocoinjs/base-x/pull/86...

SUSE CVE-2025-4086

A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected.. This vulnerability was fixed in Firefox 138...

CVE-2025-4086

This vulnerability affects Thunderbird for Android and versions of Firefox prior to 138 . A specially crafted filename containing a large number of encoded newline characters can obscure the file's extension when displayed in the download dialog. The issue was resolved in Firefox 138 and Thunderb...

CVE-2025-4035 Libsoup: cookie domain validation bypass via uppercase characters in libsoup

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set...

libsoup 安全漏洞

libsoup is a GNOME HTTP client/server library from the GNOME Project. A security vulnerability exists in libsoup that stems from bypassing cookie domain validation via capitalized characters...

firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack...