ROS-20250924-06

A vulnerability in the Django web application software platform is related to insufficient cleanup of the user data in FilteredRelation column aliases. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary SQL queries in the database A vulnerability in the...

Security update for kernel-livepatch-MICRO-6-0-RT_Update_3

This update for kernel-livepatch-MICRO-6-0-RTUpdate3 fixes the following issues: CVE-2025-38177: kernel: schhfsc: make hfscqlennotify idempotent bsc1246356 CVE-2025-38109: net/mlx5: fix ECVF vports unload on shutdown flow bsc1245685 CVE-2025-38181: calipso: fix null-ptr-deref in...

Security update for kernel-livepatch-MICRO-6-0_Update_9

This update for kernel-livepatch-MICRO-6-0Update9 fixes the following issues: CVE-2025-38498: dochangetype: refuse to operate on unmounted/not ours mounts bsc1247499 CVE-2025-38555: usb: gadget : fix use-after-free in compositedevcleanup bsc1248298 Patch Instructions: To install this SUSE update...

SUSE-SU-2025:20728-1 Security update for kernel-livepatch-MICRO-6-0-RT_Update_6

This update for kernel-livepatch-MICRO-6-0-RTUpdate6 fixes the following issues: - CVE-2025-38177: kernel: schhfsc: make hfscqlennotify idempotent bsc1246356 - CVE-2025-38109: net/mlx5: fix ECVF vports unload on shutdown flow bsc1245685 - CVE-2025-38181: calipso: fix null-ptr-deref in...

SUSE-SU-2025:20729-1 Security update for kernel-livepatch-MICRO-6-0-RT_Update_7

This update for kernel-livepatch-MICRO-6-0-RTUpdate7 fixes the following issues: - CVE-2025-38177: kernel: schhfsc: make hfscqlennotify idempotent bsc1246356 - CVE-2025-38109: net/mlx5: fix ECVF vports unload on shutdown flow bsc1245685 - CVE-2025-38181: calipso: fix null-ptr-deref in...

Security update for kernel-livepatch-MICRO-6-0-RT_Update_10

This update for kernel-livepatch-MICRO-6-0-RTUpdate10 fixes the following issues: CVE-2025-38498: dochangetype: refuse to operate on unmounted/not ours mounts bsc1247499 CVE-2025-38555: usb: gadget : fix use-after-free in compositedevcleanup bsc1248298 Patch Instructions: To install this SUSE...

Security update for kernel-livepatch-MICRO-6-0_Update_9

This update for kernel-livepatch-MICRO-6-0Update9 fixes the following issues: CVE-2025-38498: dochangetype: refuse to operate on unmounted/not ours mounts bsc1247499 CVE-2025-38555: usb: gadget : fix use-after-free in compositedevcleanup bsc1248298 Patch Instructions: To install this SUSE update...

SUSE-SU-2025:20735-1 Security update for kernel-livepatch-MICRO-6-0_Update_8

This update for kernel-livepatch-MICRO-6-0Update8 fixes the following issues: - CVE-2025-38109: net/mlx5: fix ECVF vports unload on shutdown flow bsc1245685 - CVE-2025-38181: calipso: fix null-ptr-deref in calipsoreqset,delattr bsc1246001 - CVE-2025-38498: dochangetype: refuse to operate on...

CVE-2025-39870

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix double free in idxdsetupwqs The clean up in idxdsetupwqs has had a couple bugs because the error handling is a bit subtle. It's simpler to just re-write it in a cleaner way. The issues here are: 1 If...

UBUNTU-CVE-2025-39870

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix double free in idxdsetupwqs The clean up in idxdsetupwqs has had a couple bugs because the error handling is a bit subtle. It's simpler to just re-write it in a cleaner way. The issues here are: 1 If...

CVE-2025-39870

Mode C: The CVE-2025-39870 is a Linux kernel vulnerability in dmaengine: idxd, where a double free could occur in idxd_setup_wqs() due to error handling paths (conf_dev uninitialized when max_wqs

Viessmann Vitogate 300 安全漏洞

Viessmann Vitogate 300 is a communication gateway from Viessmann, Germany. A security vulnerability exists in the Viessmann Vitogate 300 that originates from the /cgi-bin/vitogate.cgi endpoint when the form JSON parameter is set to form-0-2, which does not clean up the input correctly, and could...

ROS-20250923-23

Vulnerability in the Zabbix universal monitoring system is related to insufficient cleaning of user data transmitted via the "Visible name" field during automatic host deletion. data transmitted via the "Visible Name" field during automatic host deletion. Exploitation vulnerability could allow a...

SUSE CVE-2023-53346

In the Linux kernel, the following vulnerability has been resolved: kernel/failfunction: fix memory leak with using debugfslookup When calling debugfslookup the result must have dput called on it, otherwise the memory will leak over time. To make things simpler, just call debugfslookupandremove...

SUSE CVE-2025-39852

In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 When tcpaocopyallmatching fails in tcpv6synrecvsock it just exits the function. This ends up causing a memory-leak: unreferenced object 0xffff0000281a8200 size...

CVE-2025-51006

Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dltlinuxsll2cleanup function in plugins/dltlinuxsll2/linuxsll2.c. This vulnerability is triggered when tcpeditdltcleanup indirectly invokes the cleanup routine multiple times on the same memory region. By...

UBUNTU-CVE-2025-51006

Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dltlinuxsll2cleanup function in plugins/dltlinuxsll2/linuxsll2.c. This vulnerability is triggered when tcpeditdltcleanup indirectly invokes the cleanup routine multiple times on the same memory region. By...

CVE-2025-51006

Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dltlinuxsll2cleanup function in plugins/dltlinuxsll2/linuxsll2.c. This vulnerability is triggered when tcpeditdltcleanup indirectly invokes the cleanup routine multiple times on the same memory region. By...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

LiquidThemes MagicAI 安全漏洞

LiquidThemes MagicAI is an AI software from LiquidThemes, UK. A security vulnerability exists in LiquidThemes MagicAI version 9.1, which stems from insufficient cleanup of the prompt parameter input in the dashboard/user/generator/generate-stream endpoint, which could lead to a cross-site scripti...