CVE-2025-40837: Missing Authorization

Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with higher privileges than intended...

CVE-2025-27262: Improper Neutralization of Special Elements used in an OS Command

Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges...

CVE-2025-40838: Insufficiently Protected Credentials

Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead to unauthorized disclosure of certain information...

Ericsson Indoor Connect security vulnerability

Ericsson Indoor Connect is an indoor compact base station from Ericsson Sweden. A security vulnerability exists in Ericsson Indoor Connect version 8855, which stems from a command injection vulnerability that could lead to integrity compromise and confidentiality disclosure, as well as unauthoriz...

PT-2025-39402

Name of the Vulnerable Software and Affected Versions Ericsson Indoor Connect 8855 affected versions not specified Description The Ericsson Indoor Connect 8855 has a security issue where client-side server-side security checks can be bypassed. Successful exploitation of this issue could result in...

Ericsson Indoor Connect security vulnerability

Ericsson Indoor Connect is an indoor compact base station from Ericsson Sweden. A security vulnerability exists in Ericsson Indoor Connect version 8855, which originates from a client-side ability to bypass server-side security measures, potentially leading to unauthorized disclosure of user...

PT-2025-39394

Name of the Vulnerable Software and Affected Versions Ericsson Indoor Connect 8855 affected versions not specified Description The software contains a command injection issue that, if exploited, could result in a loss of data integrity and confidentiality. This could lead to the unauthorized...

SUSE CVE-2025-39801

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARNON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when 'paniconwarn' is enabled and unnecessary call trace prints...

GHSA-XPH5-278P-26QX lobe-chat has an Open Redirect

Description --- Vulnerability Overview The project's OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host headers and the X-Forwarded-Proto value. In deployments where a reverse proxy forwards client-supplied X-Forwarded-...

lobe-chat has an Open Redirect

Description --- Vulnerability Overview The project's OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host headers and the X-Forwarded-Proto value. In deployments where a reverse proxy forwards client-supplied X-Forwarded-...

CVE-2025-59430

Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically...

CVE-2025-58031

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Nextendweb Nextend Facebook Connect nextend-facebook-connect allows Stored XSS.This issue affects Nextend Facebook Connect : from n/a through = 3.1.19...

CVE-2025-58257

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Stored XSS.This issue affects Verowa Connect: from n/a through = 3.2.3...

CVE-2025-36064

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

Sterling Connect-Express Authentication Bypass Brute Force

The vulnerability of software for transferring files in multi-platform networks of Sterling Connect:Express is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to carry out a brute-force attack...

GitHub Mandates 2FA and Short-Lived Tokens to Strengthen npm Supply Chain Security

GitHub on Monday announced that it will be changing its authentication and publishing options "in the near future" in response to a recent wave of supply chain attacks targeting the npm ecosystem, including the Shai-Hulud attack. This includes steps to address threats posed by token abuse and...

GitHub Mandates 2FA and Short-Lived Tokens to Strengthen npm Supply Chain Security

GitHub on Monday announced that it will be changing its authentication and publishing options "in the near future" in response to a recent wave of supply chain attacks targeting the npm ecosystem, including the Shai-Hulud attack. This includes steps to address threats posed by token abuse and...

AZL-67662 CVE-2025-39880 affecting package kernel for versions less than 6.6.112.1-1

In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to cephconnectionv1info There is a place where generic code in messenger.c is reading and another place where it is writing to con-v1 union member without checking that the union member is active i.e...

CVE-2025-39880 libceph: fix invalid accesses to ceph_connection_v1_info

In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to cephconnectionv1info There is a place where generic code in messenger.c is reading and another place where it is writing to con-v1 union member without checking that the union member is active i.e...

PT-2025-44123

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the ocfs2 component related to a double free in the user cluster connect function. Specifically, user cluster disconnect frees a memory region, an...