openjdk: Enhance array handling (Oracle CPU 2025-01)

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to Oracle Java SE accessible. This vulnerability can be...

CVE-2025-21606 Local Privilege Escalation via Exposed XPC Method Due to Client Verification Failure in stats

stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of its XPC service. The application registers a Mach service under the name eu.exelban.Stats.SMC.Helper. The associated binary,...

CVE-2025-0500 Issue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clients

An issue in the native clients for Amazon WorkSpaces when running Amazon DCV protocol, Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to access remote sessions via man-in-the-middle...

Microsoft Windows Kerberos 信息泄露漏洞

Microsoft Windows Kerberos is a software for authentication in network clusters from Microsoft Corporation, U.S.A. Kerberos also serves as a network authentication protocol designed to provide strong authentication services to client/server applications through a key system. An information...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the KVM incorrectly using is64bitmode instead of is64bithypercall to detect 64-bit hypercalls when handling...

Medium: bind

Issue Overview: Sending a flood of dynamic DNS updates may cause named to allocate large amounts of memory. This, in turn, may cause named to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access...

Amazon Linux 2 : bind (ALAS-2025-2729)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2729 advisory. Sending a flood of dynamic DNS updates may cause named to allocate large amounts of memory. This, in turn, may cause named to exi...

CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies

go-git is a highly extensible git implementation library written in pure Go. A denial of service DoS vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git serve...

CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies

go-git is a highly extensible git implementation library written in pure Go. A denial of service DoS vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git serve...

CVE-2024-21464

Memory corruption while processing IPA statistics, when there are no active clients registered...

CVE-2024-21464

Memory corruption while processing IPA statistics, when there are no active clients registered...

CVE-2024-21464 Buffer Copy Without Checking Size of Input in Data Network Stack & Connectivity

Memory corruption while processing IPA statistics, when there are no active clients registered...

TLS Authentication Bypass

github.com/canonical/lxd is vulnerable to TLS Authentication Bypass. The vulnerability is due to improper certificate validation. LXD accepts non-CA signed certificates if they are present in the trust store, allowing unauthenticated clients to bypass the expected security checks...

PT-2025-16250

Name of the Vulnerable Software and Affected Versions: libsoup affected versions not specified Description: A flaw was found in libsoup, where the soup multipart new from message function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server...

SUSE-SU-2024:4436-1 Security update for grpc

This update for grpc fixes the following issues: - CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. bsc1228919 - CVE-2024-11407: data corruption on servers with transmit zero copy enabled. bsc1233821...

PT-2025-28449 · Qualcomm · Snapdragon +136

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: Memory corruption occurs while processing data packets in diag received from Unix clients. Recommendations: At the moment, there is no information about a newer version that contains a fix f...

The vulnerability of the backup and data recovery software for Veeam Service Provider Console (VSPC) users on remote and cloud-based clients stems from insufficient protection of operational data, allowing attackers to exploit this weakness to disclose sensitive information.

The vulnerability of the backup and data restoration software for Veeam Service Provider Console VSPC for remote and cloud-based customers is related to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information by...

CVE-2024-54245

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Think201 Clients clients allows Stored XSS.This issue affects Clients: from n/a through = 1.1.4...

CVE-2024-54245 WordPress Clients plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Think201 Clients clients allows Stored XSS.This issue affects Clients: from n/a through = 1.1.4...

CVE-2024-54245 WordPress Clients plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Think201 Clients clients allows Stored XSS.This issue affects Clients: from n/a through = 1.1.4...