OSV-2025-890 Heap-buffer-overflow in icalmemory_tmp_copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=458943970 Crash type: Heap-buffer-overflow WRITE 1 Crash state: icalmemorytmpcopy icalreqstattypefromstring icalvaluenewfromstring...

PT-2025-45609

Name of the Vulnerable Software and Affected Versions Looker Studio affected versions not specified Description An improper privilege management issue was identified in Looker Studio, affecting all JDBC-based connectors. A Looker Studio user with report view access could create a copy of a report...

SUSE-SU-2025:4003-1 Security update for the Linux Kernel (Live Patch 30 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-15050055121 fixes several issues. The following security issues were fixed: - CVE-2025-38664: ice: Fix a null pointer dereference in icecopyandinitpkg bsc1248631. - CVE-2022-50252: igb: Do not free qvector unless new one was allocated bsc1249847...

SUSE SLES15 Security Update : kernel (Live Patch 4 for SLE 15 SP7) (SUSE-SU-2025:3998-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:3998-1 advisory. This update for the Linux Kernel 6.4.0-1507005316 fixes one issue. The following security issue was fixed: - CVE-2025-38664: ice: Fix a null pointer...

CVE-2025-12352

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copypostimage function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...

CVE-2025-12352

The CVE-2025-12352 issue affects the WordPress Gravity Forms plugin, specifically versions up to and including 2.9.20. The vulnerability arises from missing file type validation in the copy_post_image() function, allowing unauthenticated attackers to upload arbitrary files to the affected site’s ...

CVE-2025-12352 Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copypostimage function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...

EUVD-2025-38238

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copypostimage function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...

PT-2025-45404

Name of the Vulnerable Software and Affected Versions Gravity Forms versions up to and including 2.9.20 Description The Gravity Forms plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the copy post image function. This allows...

SUSE SLES15 Security Update : kernel (Live Patch 15 for SLE 15 SP6) (SUSE-SU-2025:3970-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:3970-1 advisory. This update for the Linux Kernel 6.4.0-1506002370 fixes one issue. The following security issue was fixed: - CVE-2025-38664: ice: Fix a null pointer...

Security Bulletin: IBM Copy Services Manager may be affected by a vulnerabilities due to default security configuration allowing cross site scripting

Summary A vulnerability has been found that allows cross site scripting once a user has been authenticated or unauthenticated into the server. Although likelihood of this issue being exploited is very low, IBM Copy Services Manager frequently updates configuration files in the product dependency...

SUSE-SU-2025:3970-1 Security update for the Linux Kernel (Live Patch 15 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-1506002370 fixes one issue. The following security issue was fixed: - CVE-2025-38664: ice: Fix a null pointer dereference in icecopyandinitpkg bsc1248631...

Security update for the Linux Kernel (Live Patch 15 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-1506002370 fixes one issue. The following security issue was fixed: CVE-2025-38664: ice: Fix a null pointer dereference in icecopyandinitpkg bsc1248631. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990531)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990531 advisory. In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copyname syzbot reported BUG: KMSAN: uninit-value in...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990630)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990630 advisory. In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-complete Currently, when the user attempts symbol completion...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990423)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990423 advisory. In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe sensitive data on failure Wipe sensitive data from stack also if the copytouser...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990456)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990456 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog-jitedlen along prog-jited syzbot reported an illegal copytouser attempt fr...

CVE-2025-62520

Mantis Bug Tracker MantisBT is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to manageconfigcolumnspage.php can use the Copy From action to retrieve the columns configuration from a private project they have no...

SUSE-SU-2025:20990-1 Security update for kernel-livepatch-MICRO-6-0-RT_Update_12

This update for kernel-livepatch-MICRO-6-0-RTUpdate12 fixes the following issues: - CVE-2025-38664: ice: Fix a null pointer dereference in icecopyandinitpkg bsc1248631...

Security update for kernel-livepatch-MICRO-6-0-RT_Update_12

This update for kernel-livepatch-MICRO-6-0-RTUpdate12 fixes the following issues: CVE-2025-38664: ice: Fix a null pointer dereference in icecopyandinitpkg bsc1248631 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...