Correctly Configure the Default File Permission For rsyslog

Log files record system behaviors. The rsyslog log tool records logs in specified files. When the specified log file does not exist in the system, rsyslog creates a log file. The permission of the created log file can be configured in the rsyslog configuration file. The configuration of the defau...

Configure a Proper Number of Concurrent Sessions Allowed for a Single SSH Connection

SSH allows a client that supports multiplexing to establish multiple sessions based on a network connection. MaxSessions limits the number of concurrent SSH sessions that can be established for each network connection. This prevents system resources from being occupied by a single connection or a...

Ensure That the LD_LIBRARY_PATH Environment Variable Is Correctly Defined

LDLIBRARYPATH is an environmental variable in Linux. When loading a dynamic link library, the program preferentially obtains the library from the path specified by LDLIBRARYPATH. Generally, LDLIBRARYPATH should not be set, because a maliciously set value will make the program link to an incorrect...

Configure a Proper Value for audit_backlog_limit

auditbackloglimit sets the buffer queue length for audit events awaiting transfer to the audit service. The default value is 64. If the queue is full, audit events are discarded and an alarm log is generated, indicating that the queue is full. If the value is too small, audit events may be lost. ...

Configure the Core Dump Properly

A core dump records the memory status when a program stops abnormally or breaks down. It helps locate faults but may contain sensitive information in the process memory. In some cases, the core dump function needs to be enabled to record problem causes. When enabling the core dump function,...

Ensure That a User Is Locked After a Specified Number of Login Failures

If a user fails to log in to the system for a specified number of consecutive times, the system locks the user. That is, the user is not allowed to log in to the system for a specified period of time to prevent malicious system password cracking. During the lockout period, any input is considered...

Do Not Enable Login Capabilities for Users Who Are Not Meant for Direct Login

Typically, a Linux system has multiple users, not all of which are used for login. For instance, some users are automatically created during the installation of software packages like systemd and dhcp. These users serve specific purposes, such as running related software services. It is essential...

Do Not Preset authorized_keys for the SSH Service

authorizedkeys specifies the public key of the remote host. You can store the public key in the $HOME/.ssh/authorizedkeys file in the home directory for public key authentication. Then you can directly log in to the system. If authorizedkeys is preset in the system and public and private key...

Ensure That the Log Size Limit Is Correct

The size of an audit log file must be limited. The log rotation mechanism can be used to create new log files once the file size limit is reached. If the upper limit is too high, the size of a single log file may be too large, which is inconvenient for management. If the upper limit is too low, t...

CVE-2024-12225

A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide custom REST endpoints, the default...

CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass

A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide custom REST endpoints, the default...

DEBIAN-CVE-2025-32022

Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects...

soundness issue and unmaintained

wrenrust::macros::defaultrealloc lacks sufficient checks to it pointer parameter which passed into free and realloc wrenrust is unmaintained...

RUSTSEC-2025-0064 soundness issue and unmaintained

wrenrust::macros::defaultrealloc lacks sufficient checks to it pointer parameter which passed into free and realloc wrenrust is unmaintained...

firefox security update

128.10.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 - Force use of gcc-toolset-13 due to clang dependency 128.10.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 128.10.0-1 - Update to 128.10.0 build1...

Quarkus 安全漏洞

Quarkus is a cloud-native Linux container-first framework for writing Java applications from the Quarkus open source. A security vulnerability exists in Quarkus that stems from an undisabled default REST endpoint in the quarkus-security-webauthn module, which could lead to arbitrary user login...

PT-2025-19841

Name of the Vulnerable Software and Affected Versions Quarkus affected versions not specified Description A vulnerability was found in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in, and when developers provi...

Exploit for Unrestricted Upload of File with Dangerous Type in Emagicone Emagicone_Store_Manager_For_Woocommerce

eMagicOne Store Manager for WooCommerce 1: lo: mtu 65536 qdis...

CVE-2025-1992 IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user in federation environment, to cause a denial of service due to insufficient release of allocated memory after usage...

CVE-2025-1992 IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user in federation environment, to cause a denial of service due to insufficient release of allocated memory after usage...