Cisco IOS XE Wireless Controller Arbitrary File Upload (cisco-sa-wlc-file-uplpd-rHZG9UfC)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. - A vulnerability in the Out-of-Band Access Point AP Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary...

CVE-2025-29686

A cross-site scripting XSS vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /inform/InformManageController.java...

CVE-2025-29689

A cross-site scripting XSS vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java...

CVE-2025-29690

A cross-site scripting XSS vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java...

Cisco IOS XE Wireless Controller Software Access Control Error Vulnerability

Cisco IOS XE Wireless Controller software is a wireless LAN controller from Cisco. The Cisco IOS XE Wireless Controller Software suffers from an Access Control Error vulnerability that stems from insufficient access control and can be exploited by an attacker to cause the deletion of arbitrary us...

PT-2025-21165 · Invision · Invision Community

Name of the Vulnerable Software and Affected Versions: Invision Community versions 5.0.0 through 5.0.7 Description: The issue lies within the themeeditor controller, where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content...

oa_system 跨站脚本漏洞

oasystem is a hailey individual developer's application for the daily operation and management of organizations, used by employees and managers. A security vulnerability exists in oasystem versions prior to v2025.01.01, which stems from improperly cleaned inputs for the parameter title in the fil...

oa_system 跨站脚本漏洞

oasystem is a hailey individual developer's application for the day-to-day operation and management of organizations, used by employees and managers. A security vulnerability exists in oasystem versions prior to v2025.01.01, which stems from improperly cleaned input of the parameter password in t...

CVE-2025-20100

Improper access control in the memory controller configurations for some IntelR XeonR 6 processor with E-cores may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2025-20100

Improper access control in the memory controller configurations for some IntelR XeonR 6 processor with E-cores may allow a privileged user to potentially enable escalation of privilege via local access...

kernel: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()

A NULL pointer dereference was found in the Linux kernel in case of DT error in kspciesetuprcappregs. This may lead to a crash...

kernel: pmdomain: imx93-blk-ctrl: correct remove path

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: correct remove path The check condition should be 'i onecelldata.numdomains', not 'bc-onecelldata.numdomains' which will make the look never finish and cause kernel panic. Also disable runtime to address...

kernel: usb: dwc3: core: Prevent USB core invalid event buffer address access

A flaw was found in the Linux kernel's USB dwc3 core. During runtime suspend, the USB core could attempt to access an invalid event buffer address. This issue, particularly affecting Exynos platforms, can lead to System Memory Management Unit SMMU faults and other memory-related problems,...

kernel: xhci: tegra: fix checked USB2 port number

A flaw was found in the Linux kernel's xHCI eXtensible Host Controller Interface Tegra driver. When USB virtualization is enabled and USB2 ports are shared across virtual functions, an incorrect port number check can lead to invalid memory access. A local attacker with high privileges could explo...

kernel: PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert()

In the Linux kernel, the following vulnerability has been resolved: PCI: tegra194: Move controller cleanups to pexepeventpexrstdeassert Currently, the endpoint cleanup function dwpcieepcleanup and EPF deinit notify function pciepcdeinitnotify are called during the execution of...

kernel: EDAC/bluefield: Fix potential integer overflow

In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM info" SMC call consists of memctrlidx left-shifted 16 bits and OR-ed with DIMM index. With memctrlidx defined as 32-bits wide the left-shift...

kernel: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails

A flaw was found in the hwmon hardware monitoring subsystem of the Linux kernel, specifically within the ibmpex driver. This vulnerability is a Use-After-Free UAF error, which occurs when the system attempts to use memory that has already been released. An attacker with administrative privileges...

kernel: Bluetooth: HCI: Fix potential null-ptr-deref

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Fix potential null-ptr-deref Fix potential null-ptr-deref in hcilebigsyncestablishedevt...

kernel: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync

A flaw was found in the Linux kernel's Bluetooth subsystem. When an Asynchronous Connection-Less ACL connection is destroyed while the hcienhancedsetupsync function is processing a command, it can lead to a use-after-free UAF condition. An adjacent attacker could exploit this vulnerability to cau...

kernel: nvme-rdma: unquiesce admin_q before destroy it

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: unquiesce adminq before destroy it Kernel will hang on destroy adminq while we create ctrl failed, such as following calltrace: PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme" 0 ff61d23de260fb78 schedule at...