Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Scsi: UFS: Core – Fixed an issue where a “use-after-free” occurred during initialization errors. Also, removed unnecessary paths related to this issue. The devmblkcryptoprofileinit function registers a cleanup handler to be...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: drm/sched: Fixed the leak caused by referencing the fence’s reference count. The lastscheduled fence leaks occurs when an entity is being terminated, and the cleanup callback fails. The reference count of prev was decremented...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: idpf: fixed the issue where the NULL pointer dereferencing occurred during reboot. When SRIOV is enabled, idpf calls idpfremove twice. First, via idpfshutdown, and then again when idpfremove calls sriovdisable. This is because...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fixed a deadlock in ivpumscleanup. The deadlock was resolved by preventing runtime resumption after filepriv-mslock is acquired. During a failure in runtime resumption, a cold boot is executed, which calls...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: rxrpc, afs: Fixed peer hash locking issues related to RCU callbacks. In its address list, afa now retains pointers to and references to one or more rxrpcpeer objects. The address list is freed under RCU; currently, the references...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: octeonep: Fixed the issue where the host would hang during device reboot. When the host loses heartbeat messages from the device, the driver calls the device-specific ndostop function, which frees the resources. If the driver is...

PT-2025-27960

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the atmtcp c send function in the Linux kernel, where it accesses skb-data as struct atmtcp hdr after checking if skb-len is 0, but this check is not sufficient...

Conda-build path traversal vulnerability

Conda-build is a Conda open source command and tool for building conda packages. A path traversal vulnerability exists in versions of Conda-build prior to 25.4.0 that stems from improper path cleanup of tar entries, which could lead to a path traversal attack...

WordPress plugin “Simply Schedule Appointments” has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A cross-site scripting...

WordPress plugin "Click to Chat" vulnerable to cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Click to Chat plugin, which stems from insufficient input cleanup and escaping, and can be exploited by an attacker ...

Malicious code in react-sdk-module-api (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c328baa339da0fb222b6ed839e9e024e3df2427f155e95d650451d9a7c0d49ce Any computer that has this package installed or running should be considered...

WordPress plugin for the “Contact Us” page – Allows users to contact others. Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Contact Us Page - Contact People plugin, which stems from insufficient input cleanup and escaping, and can be...

WordPress plugin IRM Newsroom has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin IRM Newsroom has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Color Palette has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Color Palette plugin, which stems from insufficient input cleanup and escaping, and can be exploited by an attacker ...

WordPress Network Posts Extended Cross-Site Scripting Vulnerability

WordPress Network Posts Extended is a WordPress plugin that enhances post publishing and management on WordPress websites. A cross-site scripting vulnerability exists in WordPress Network Posts Extended. The vulnerability stems from insufficient input cleanup and escaping of the postheight...

WordPress Plugin “Game Review Block” suffers cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

Trend Micro Apex One Damage Cleanup Engine Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...

WordPress WP Info Card plugin cross-site scripting vulnerability

WordPress WP Info Card plugin is a plugin for displaying plugin and theme information in your WordPress website. The WordPress WP Info Card plugin suffers from a cross-site scripting vulnerability that stems from insufficient input cleanup and output escaping, which can be exploited by an attacke...

WordPress WP Easy Contact plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress WP Easy Contact plugin, which stems from insufficient input cleanup and output escaping, and can be exploited by an...