Azure Linux 3.0 Security Update: kernel (CVE-2024-50059)

"The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50059 advisory. - In the Linux kernel, the following vulnerability has been resolved: ntb: ntbhwswitchtec: Fix use after free...

OpenProject cross-site scripting vulnerabilities

OpenProject is a web-based project management software from OpenProject Open Source. A cross-site scripting vulnerability exists in versions of OpenProject prior to 15.2.1, which stems from a failure to properly clean up user input in the group management section and could lead to a cross-site...

Exploit for Off-by-one Error in Sudo_Project Sudo

Baron Samedit PoC Description This is a Proof-of-Concept...

WordPress plugin “Simple” adds pages or posts; cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

Malicious code in trufflevscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf08d3952be6248181a39013b0923365cf27f422f56a1e3ca9addb9d8099e452 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CoreMedia DoS

The vulnerability of the CoreMedia component in operating systems such as macOS, iOS, iPadOS, watchOS, tvOS, and visionOS is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

ARKit DoS

The vulnerability of the ARKit interface in operating systems such as macOS, iOS, iPadOS, tvOS, and visionOS is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

Joplin input validation vulnerability

Joplin is an open source note-taking and to-do list application by Laurent Cozic Individual Developer. Joplin suffers from an input validation error vulnerability that originates in Joplin's HTML cleanup program that could result in a denial of service if the value of the specified name attribute...

SFTPGo operating system command injection vulnerability

SFTPGo is a full-featured and highly configurable SFTP server from the individual developer Nicola Murino in Italy. SFTPGo suffers from an operating system command injection vulnerability that stems from a lack of cleanup of the rsync command, allowing remote users to read or write files...

CLSA-2025-1738853271 Fix of 54 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26595 - mlxsw: spectrumacltcam: Fix NULL pointer dereference in error path CVE-url: https://ubuntu.com/security/CVE-2024-38553/CVE-2024-38597 - netpoll: make ndopollcontroller optional - bonding: use netpollpolldev helper - netpoll: do not test...

CVE-2025-23832

Cross-Site Request Forgery CSRF vulnerability in Matt Gibbs Admin Cleanup admin-cleanup allows Stored XSS.This issue affects Admin Cleanup: from n/a through = 1.0.2...

CVE-2025-24563

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themeglow Cleanup – Directory Listing & Classifieds WordPress Plugin cleanup-light allows Reflected XSS.This issue affects Cleanup – Directory Listing & Classifieds WordPress Plugin: from n/a throu...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: sched: schmultiq: fix possible OOB write in multiqtune CVE-2024-36978 In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: sched: schmultiq: fix possible OOB write in multiqtune CVE-2024-36978 In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized...

Important: kernel-livepatch-5.10.228-219.884

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in gfs2qddealloc CVE-2023-52760 In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfochangednotify CVE-2024-36899 In the...

Malicious code in action-npm-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 048a0cf0cca0b18a85e69e831d1c26f1bec7888c3f5e1865bd185b3470fb9e2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2025:20003-1 Security update for util-linux

This update for util-linux fixes the following issues: Security issue fixed: - CVE-2024-28085: Properly neutralize escape sequences in wall to avoid potential account takeover. bsc1221831 Non-security issues fixed: - Fix hang of lscpu -e bsc1225598 - lscpu: Add more ARM cores bsc1223605 - Documen...

Security update for util-linux

This update for util-linux fixes the following issues: Security issue fixed: CVE-2024-28085: Properly neutralize escape sequences in wall to avoid potential account takeover. bsc1221831 Non-security issues fixed: Fix hang of lscpu -e bsc1225598 lscpu: Add more ARM cores bsc1223605 Document that...

Malicious code in cs-count (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6961148d61a9a3b12afb0f91d6d4647b2c986b36b0521d40567c9c5aa5860ead Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2025-21672

In the Linux kernel, the following vulnerability has been resolved: afs: Fix merge preference rule failure condition syzbot reported a lock held when returning to userspace1. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released. Fix this by...