Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in SharpFormUploadField.php. An attacker can execute arbitrary scripts in the context of a user's browser by submitting crafted input. Details Cross-site scripting or XSS is a code vulnerability that occurs when...

openSUSE Security Advisory (SUSE-SU-2025:03624-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

JLSEC-2025-101 FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in...

FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbsav1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the vfinfo function responsible for handling certain binary files. An attacker can cause a denial of service by providing a specially crafted input file that triggers an out-of-bounds read during processing...

Unchecked Return Value

Overview Affected versions of this package are vulnerable to Unchecked Return Value in the tgtagtype function. An attacker can cause a denial of service by providing crafted input that triggers improper handling of return values. Remediation A fix was pushed into the master branch but not yet...

EUVD-2025-34667

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 running Cisco SIP Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to a buffer overflow...

CVE-2025-9337

A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a specially crafted input, which may lead to a system crash BSOD. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information...

Adobe Substance3D Viewer 安全漏洞

Adobe Substance3D Viewer is a stand-alone desktop application for viewing and editing 3D files from Audobee Adobe USA. A security vulnerability exists in Adobe Substance3D Viewer 0.25.2 and earlier versions, which can be exploited by an attacker to cause arbitrary code execution in the current us...

EUVD-2025-34059

A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a specially crafted input, which may lead to a system crash BSOD. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information...

CVE-2025-9337

A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a specially crafted input, which may lead to a system crash BSOD. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information...

CVE-2025-9337

The vulnerability is a null pointer dereference in the AsIO3.sys driver used by ASUS Armoury Crate. Affected component: AsIO3.sys; root cause: null pointer dereference triggered by specially crafted input. Consequence: system crash (BSOD). References to ASUS advisory indicate impact tied to Armou...

CVE-2025-9337

A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a specially crafted input, which may lead to a system crash BSOD. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information...

CVE-2025-31993

HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery SSRF. An attacker can exploit improper input validation by submitting maliciously crafted input to a target application running on a server...

ASUS Armoury Crate 安全漏洞

ASUS Armoury Crate is a utility software developed by ASUS to centrally control and manage ROG Gamerland and some ASUS gaming products. ASUS Armoury Crate suffers from a null pointer dereference vulnerability that can be exploited by attackers to cause a system crash...

PT-2025-41782

Name of the Vulnerable Software and Affected Versions ASUS versions affected versions not specified Description A flaw exists in the AsIO3.sys driver where a specially crafted input can cause a null pointer dereference, potentially leading to a system crash, also known as a Blue Screen of Death...

Security update for expat

This update for expat fixes the following issues: CVE-2025-59375: memory amplification vulnerability allows attackers to trigger excessive dynamic memory allocations by submitting crafted XML input bsc1249584. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

SUSE-SU-2025:03537-1 Security update for expat

This update for expat fixes the following issues: - CVE-2025-59375: memory amplification vulnerability allows attackers to trigger excessive dynamic memory allocations by submitting crafted XML input bsc1249584...

Security update for expat

This update for expat fixes the following issues: CVE-2025-59375: memory amplification vulnerability allows attackers to trigger excessive dynamic memory allocations by submitting crafted XML input bsc1249584. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

JLSEC-2025-17 A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4

A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untruste...

CVE-2025-62239

Cross-site scripting XSS vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HT...