CVE-2025-14187 UGREEN DH2100+ nas_svr create handler_file_backup_create buffer overflow

A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function handlerfilebackupcreate of the file /v1/file/backup/create of the component nassvr. Executing a manipulation of the argument path can lead to buffer overflow. The attack can be executed remotely. The...

CVE-2025-14187

Summary of CVE-2025-14187 (UGREEN DH2100+) Affects the nas_svr component of UGREEN DH2100+ up to 5.3.0.251125. The vulnerability resides in the function handler_file_backup_create for the API endpoint /v1/file/backup/create where manipulation of the path argument can cause a remote buffer overflo...

PT-2025-49400

Name of the Vulnerable Software and Affected Versions UGREEN DH2100+ versions through 5.3.0.251125 Description A flaw exists in UGREEN DH2100+ that could allow for remote buffer overflow. The issue is related to the handler file backup create function within the nas svr component, specifically wh...

UGREEN DH2100+ Command Injection Vulnerability

UGREEN DH2100+ is a private cloud storage device from China Greenlink UGREEN. A command injection vulnerability exists in UGREEN DH2100+ 5.3.0.251125 and earlier versions, which stems from the incorrect manipulation of the parameter path by the function handlerfilebackupcreate in the file...

UGREEN DH2100+ security vulnerabilities

UGREEN DH2100+ is a private cloud storage device from China Greenlink UGREEN. A security vulnerability exists in UGREEN DH2100+ 5.3.0.251125 and earlier versions, which originates from a misbehavior of the parameter path in the function handlerfilebackupcreate in the file /v1/file/backup/create i...

CVE-2025-13358

The Accessiy By CodeConfig Accessibility plugin for WordPress is vulnerable to unauthorized page creation due to missing authorization checks in versions up to, and including, 1.0.0. This is due to the plugin not performing capability checks in the Settings::createPage function. This makes it...

[SECURITY] Fedora 42 Update: abrt-2.17.8-1.fc42

abrt is a tool to help users to detect defects in applications and to create a bug report with all information needed by maintainer to fix it. It uses plugin system to extend its functionality...

PT-2025-49326

The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the create item permissions check function. This makes it possible for authenticate...

Access Control Bypass

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Access Control Bypass via the /admin/realms/master/users/profile endpoint. An attacker can access internal us...

auth0/node-jws Improperly Verifies HMAC Signature

Overview An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions. Am I Affected? You are affected by this vulnerability if you meet all of the following preconditions: 1. Application uses the auth0/node-jws implementatio...

postgresql: CREATE STATISTICS does not check for schema CREATE privilege

A vulnerability has been identified in PostgreSQL’s CREATE STATISTICS command where the database does not check that the user has the required schema CREATE privilege. A table owner user could create a statistics object in any schema, blocking other users who legitimately hold CREATE STATISTICS...

Ubuntu: Security Advisory (USN-7908-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : PostgreSQL vulnerabilities (USN-7908-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7908-1 advisory. Jelte Fennema-Nio discovered that the PostgreSQL CREATE STATISTICS command did not correctly check for schema CREATE...

DRUPAL-CONTRIB-2025-117

This module allows uploading a zip file and extracting its content in the public file directory to serve this content from a Drupal website. These zip files may contain arbitrary HTML or SVG content that could allow cross-site scripting vulnerabilities. While this is an expected feature, the modu...

USN-7908-1 postgresql-14, postgresql-16, postgresql-17 vulnerabilities

Jelte Fennema-Nio discovered that the PostgreSQL CREATE STATISTICS command did not correctly check for schema CREATE privileges. An authenticated attacker could possibly use this issue to create a denial of service against other CREATE STATISTICS users. CVE-2025-12817 Aleksey Solovev discovered...

USN-7908-1: PostgreSQL vulnerabilities

Jelte Fennema-Nio discovered that the PostgreSQL CREATE STATISTICS command did not correctly check for schema CREATE privileges. An authenticated attacker could possibly use this issue to create a denial of service against other CREATE STATISTICS users. CVE-2025-12817 Aleksey Solovev discovered...

PT-2025-48951

Name of the Vulnerable Software and Affected Versions WebPros Plesk versions prior to 18.0.73.5 WebPros Plesk versions 18.0.74 through 18.0.74.2 Description A remote, authenticated user can execute arbitrary code as root through domain creation. An attacker requires “Create and manage sites” with...

LIVE555 Streaming Media Heap Buffer Overflow Vulnerability (CNVD-2025-30509)

LIVE555 Streaming Media is a cross-platform C++ open source library , focusing on providing solutions for streaming media applications , supporting a variety of standard protocols such as RTP/RTCP, RTSP and SIP. LIVE555 Streaming Media suffers from a heap buffer overflow vulnerability that stems...

drivers/gpu/drm/xe/xe_bb.c Heap Buffer Overflow DoS

Vulnerability of the xebbcreatejob function in the drivers/gpu/drm/xe/xebb.c module – The DRI driver for Linux’s direct rendering infrastructure is vulnerable due to a buffer copy operation without input data validation. Exploiting this vulnerability could allow an attacker to cause service...

vmwgfx Heap Buffer Overflow DoS

Vulnerability of the vmwframebuffersurfacecreatehandle function in the drivers/gpu/drm/vmwgfx/vmwgfxkms.c module – The Linux kernel’s DRI driver support mechanism relies on pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a system failure...