CVE-2025-4084 Potential local code execution in "copy as cURL" command

Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.. Thi...

CVE-2025-4089: Improper Neutralization of Special Elements used in a Command

Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 138 and Thunderbird 138...

Mozilla Firefox security vulnerabilities

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in versions of Mozilla Firefox prior to 138, which stems from an insufficient escaping of special characters by the copy as cURL feature, which could lead to native code...

CVE-2025-4084: Improper Encoding or Escaping of Output

Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.. Thi...

Mozilla Firefox ESR security vulnerabilities

Mozilla Firefox ESR is an extended support release of Firefox web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox ESR versions prior to 128.10 and prior to 115.23, which stems from insufficient escaping of special characters by the copy...

Mozilla -- insufficient character escaping

[email protected] reports: Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system...

TOTOLINK N150RT Router Buffer Overflow

The vulnerability of TOTOLINK N150RT router microprogramming software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted POST request...

CVE-2025-46333 z2d OOB composition could lead to invalid memory access and corruption

z2d is a pure Zig 2D graphics library. Versions of z2d after 0.5.1 and up to and including 0.6.0, when writing from one surface to another using z2d.compositor.StrideCompositor.run, and higher-level operations when the anti-aliasing mode is set to .default such as Context.fill, Context.stroke,...

WebKitGTK WebKit Buffer Overflow

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

CVE-2025-28019: Buffer Copy without Checking Size of Input

TOTOLINK A800R V4.1.2cu.5137B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi component...

Moodle Cross-Site Request Forgery Vulnerability

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from a lack of cross-site request forgery protection that allows an...

PT-2026-49269

Name of the Vulnerable Software and Affected Versions GPAC MP4Box version 2.4 Description A NULL pointer dereference occurs in the gf isom copy sample info function within the isomedia/isom write.c file. This issue allows a remote attacker to trigger a Denial of Service DoS by providing a special...

SUSE CVE-2025-39989

In the Linux kernel, the following vulnerability has been resolved: x86/mce: use iscopyfromuser to determine copy-from-user context Patch series "mm/hwpoison: Fix regressions in memory failure handling", v4. 1. What am I trying to do: This patchset resolves two critical regressions related to...

AZL-69728 CVE-2025-39989 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: x86/mce: use iscopyfromuser to determine copy-from-user context Patch series "mm/hwpoison: Fix regressions in memory failure handling", v4. 1. What am I trying to do: This patchset resolves two critical regressions related to...

DEBIAN-CVE-2025-39989

In the Linux kernel, the following vulnerability has been resolved: x86/mce: use iscopyfromuser to determine copy-from-user context Patch series "mm/hwpoison: Fix regressions in memory failure handling", v4. 1. What am I trying to do: This patchset resolves two critical regressions related to...

CVE-2025-39989

In the Linux kernel, the following vulnerability has been resolved: x86/mce: use iscopyfromuser to determine copy-from-user context Patch series "mm/hwpoison: Fix regressions in memory failure handling", v4. 1. What am I trying to do: This patchset resolves two critical regressions related to...

CVE-2025-39989

In the Linux kernel, the following vulnerability has been resolved: x86/mce: use iscopyfromuser to determine copy-from-user context Patch series "mm/hwpoison: Fix regressions in memory failure handling", v4. 1. What am I trying to do: This patchset resolves two critical regressions related to...

UBUNTU-CVE-2025-39989

In the Linux kernel, the following vulnerability has been resolved: x86/mce: use iscopyfromuser to determine copy-from-user context Patch series "mm/hwpoison: Fix regressions in memory failure handling", v4. 1. What am I trying to do: This patchset resolves two critical regressions related to...

CVE-2025-39989

The CVE-2025-39989 issue affects the Linux kernel’s x86 memory error handling (MCE) path. Root cause: a patch series changes the copy-from-user recovery flow by introducing and switching extable fixup types, notably EX_TYPE_EFAULT_REG, instead of handling EX_TYPE_UACCESS for poison found in get_u...

CVE-2025-32784

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastructure. This vulnerability, categorized a...