Ruckus IoT Controller 1.7.1.0 - Undocumented Backdoor Account

Exploit Title: CommScope Ruckus IoT Controller 1.7.1.0 - Undocumented Account Date: 2021.05.26 Exploit Author: korelogic Vendor Homepage: https://www.commscope.com/globalassets/digizuite/917216-faq-security-advisory-id-20210525-v1-0.pdf Affected Product: Ruckus IoT Controller Version: 1.7.1.0 and...

Argument Injection

Overview Affected versions of this package are vulnerable to Argument Injection via the FFmpeg codec. An attacker in possession of a valid itemId can execute arbitrary code by injecting unsanitized parameters at the /Videos//stream or /Videos//stream. endpoints. Remediation Upgrade...

CVE-2025-28399

An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class...

CVE-2025-28399

An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class...

Security Bulletin: IBM Cognos Controller is affected by vulnerabilities

Summary There are vulnerabilities in IBM® Java™, IBM® Websphere Application Server Liberty and Open-Source Software OSS components used by IBM Cognos Controller. Additionally, IBM Cognos Controller has addressed vulnerabilities that could lead to Cross-Site Scripting XSSCVE-2024-28776, XML Extern...

Security Bulletin: IBM Cognos Controller is affected by vulnerabilities

Summary There are vulnerabilities in IBM® Java™, IBM® Websphere Application Server Liberty and Open-Source Software OSS components used by IBM Cognos Controller. Please refer to the table in the Related Information section for vulnerability impact. This Security Bulletin relates only to the direc...

Security Bulletin: IBM Controller is affected by vulnerabilities

Summary There are vulnerabilities in IBM® Websphere Application Server Liberty and Open-Source Software OSS components used by IBM Controller. Additionally, due to weak password requirements, IBM Controller is susceptible to compromised user accounts. Please refer to the table in the Related...

CVE-2025-28399

An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class...

CVE-2025-28399

An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class...

CVE-2025-28399

An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class...

PT-2025-16382 · Unknown · Erick Xmall

Name of the Vulnerable Software and Affected Versions: Erick xmall versions 1.1 and earlier Description: An issue in Erick xmall allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class. Recommendations: For Erick xmall versions 1.1 and earlier,...

CVE-2025-28399: Improper Privilege Management

An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class...

XMall security vulnerabilities

XMall is a distributed e-commerce shopping mall based on SOA architecture by an individual developer at Exrick. A security vulnerability exists in XMall 1.1 and earlier versions, which stems from an elevation of privilege in the updateAddress method of the Address Controller class...

CVE-2025-28399

A security vulnerability in Erick xmall (versions 1.1 and earlier ) allows a remote attacker to perform a privilege escalation attack. The flaw is located specifically in the updateAddress method of the Address Controller class. Impacting the confidentiality, integrity, and availability of the sy...

pinctrl-single.c Heap Buffer Overflow DoS

Vulnerability of the pcssetmux function in the drivers/pinctrl/pinctrl-single.c module – The Linux kernel’s PINCTRL output controller support driver relies on the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization CVE-2024-58092 In the Linux kernel, the following vulnerability has been resolved: keys: Fix UAF in keyput CVE-2025-21893 In the Linux kernel, the following...

nci_close_device Heap Buffer Overflow DoS

The vulnerability of the nciclosedevice function in the net/nfc/nci/core.c module, which supports NFC NCI implementations in Linux operating systems, is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

ufshcd_exec_dev_cmd Heap Buffer Overflow DoS

Vulnerability of the ufshcdexecdevcmd function in the drivers/scsi/ufs/ufshcd.c module – The Linux kernel’s SCSI device support driver is vulnerable to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: helm-push, kubescape, zot, k8ssandra-client, tw, kots, helm-docs, flux-helm-controller, k9s, zarf, eksctl, flux-source-controller, cert-manager-cmctl, cilium-cli, rancher-helm, pluto, cluster-api-helm-controller, chartmuseum, flux, helm-operator, trivy, chart-testing...

GHSA-4HFP-H4CW-HJ8P vulnerabilities

Vulnerabilities for packages: helm-push, kubescape, zot, k8ssandra-client, tw, kots, helm-docs, flux-helm-controller, k9s, zarf, eksctl, flux-source-controller, cert-manager-cmctl, cilium-cli, rancher-helm, pluto, cluster-api-helm-controller, chartmuseum, flux, helm-operator, trivy, chart-testing...