PT-2025-21165 · Invision · Invision Community

Name of the Vulnerable Software and Affected Versions: Invision Community versions 5.0.0 through 5.0.7 Description: The issue lies within the themeeditor controller, where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content...

oa_system 跨站脚本漏洞

oasystem is a hailey individual developer's application for the daily operation and management of organizations, used by employees and managers. A security vulnerability exists in oasystem versions prior to v2025.01.01, which stems from improperly cleaned inputs for the parameter title in the fil...

oa_system 跨站脚本漏洞

oasystem is a hailey individual developer's application for the day-to-day operation and management of organizations, used by employees and managers. A security vulnerability exists in oasystem versions prior to v2025.01.01, which stems from improperly cleaned input of the parameter password in t...

CVE-2025-20100

Improper access control in the memory controller configurations for some IntelR XeonR 6 processor with E-cores may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2025-20100

Improper access control in the memory controller configurations for some IntelR XeonR 6 processor with E-cores may allow a privileged user to potentially enable escalation of privilege via local access...

kernel: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()

A NULL pointer dereference was found in the Linux kernel in case of DT error in kspciesetuprcappregs. This may lead to a crash...

kernel: usb: dwc3: core: Prevent USB core invalid event buffer address access

A flaw was found in the Linux kernel's USB dwc3 core. During runtime suspend, the USB core could attempt to access an invalid event buffer address. This issue, particularly affecting Exynos platforms, can lead to System Memory Management Unit SMMU faults and other memory-related problems,...

kernel: pmdomain: imx93-blk-ctrl: correct remove path

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: correct remove path The check condition should be 'i onecelldata.numdomains', not 'bc-onecelldata.numdomains' which will make the look never finish and cause kernel panic. Also disable runtime to address...

kernel: EDAC/bluefield: Fix potential integer overflow

In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM info" SMC call consists of memctrlidx left-shifted 16 bits and OR-ed with DIMM index. With memctrlidx defined as 32-bits wide the left-shift...

kernel: PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert()

In the Linux kernel, the following vulnerability has been resolved: PCI: tegra194: Move controller cleanups to pexepeventpexrstdeassert Currently, the endpoint cleanup function dwpcieepcleanup and EPF deinit notify function pciepcdeinitnotify are called during the execution of...

kernel: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails

A flaw was found in the hwmon hardware monitoring subsystem of the Linux kernel, specifically within the ibmpex driver. This vulnerability is a Use-After-Free UAF error, which occurs when the system attempts to use memory that has already been released. An attacker with administrative privileges...

kernel: xhci: tegra: fix checked USB2 port number

A flaw was found in the Linux kernel's xHCI eXtensible Host Controller Interface Tegra driver. When USB virtualization is enabled and USB2 ports are shared across virtual functions, an incorrect port number check can lead to invalid memory access. A local attacker with high privileges could explo...

kernel: nvme-rdma: unquiesce admin_q before destroy it

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: unquiesce adminq before destroy it Kernel will hang on destroy adminq while we create ctrl failed, such as following calltrace: PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme" 0 ff61d23de260fb78 schedule at...

kernel: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync

A flaw was found in the Linux kernel's Bluetooth subsystem. When an Asynchronous Connection-Less ACL connection is destroyed while the hcienhancedsetupsync function is processing a command, it can lead to a use-after-free UAF condition. An adjacent attacker could exploit this vulnerability to cau...

kernel: Bluetooth: HCI: Fix potential null-ptr-deref

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Fix potential null-ptr-deref Fix potential null-ptr-deref in hcilebigsyncestablishedevt...

USN-7506-4 linux-lts-xenial vulnerabilities

Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in...

Siemens OZW672 操作系统命令注入漏洞

The OZW device web server is used for remote monitoring of building controller devices, e.g. for monitoring heating control or air conditioning status. A code execution and SQL injection vulnerability exists in the Siemens OZW672 and OZW772 web servers, which can be exploited by an attacker to...

Siemens SIMATIC IPC RS-828A

SUMMARY SIMATIC IPC RS-828A is affected by an authentication bypass vulnerability in the Redfish interface of its Baseboard Management Controller BMC that could allow an attacker to gain unauthorized access and compromise confidentiality, integrity and availability of the BMC and thus the entire...

Intel® Xeon® 6 processor with E-cores Advisory

Summary: Potential security vulnerability in memory controller configurations for some Intel® Xeon® 6 processor with Efficient-cores E-cores may allow escalation of privilege. Intel is releasing a firmware update to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-201...

Intel Xeon 6 Processor 访问控制错误漏洞

The Intel Xeon 6 Processor is a new generation of server processors from Intel aimed at data centers, artificial intelligence AI and high performance computing HPC. The Intel Xeon 6 Processor suffers from an improper access control vulnerability that stems from improper access control of the memo...