[SECURITY] [DLA 4080-1] libaws security update

Debian LTS Advisory DLA-4080-1 [email protected] https://www.debian.org/lts/security/ Andreas Henriksson March 09, 2025 https://wiki.debian.org/LTS Package : libaws Version : 20.2-2+deb11u1 CVE ID : CVE-2024-55581 Debian Bug : AdaCore released a security advisory for "Insecure defaults ...

AZL-58917 CVE-2025-21796 affecting package kernel for versions less than 6.6.82.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear aclaccess/acldefault after releasing them If getting acldefault fails, aclaccess and acldefault will be released simultaneously. However, aclaccess will still retain a pointer pointing to the released posixacl, which...

Moxa EDS-4000/G4000 Series Initialization of a Resource with an Insecure Default (CVE-2024-0387)

The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests. This plugi...

CVE-2025-0796

The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.10. This is due to missing or incorrect nonce validation on the 'wprequalresetdefaults' action. This makes it possible for unauthenticated attackers to reset...

PT-2025-6800 · WordPress · Mortgage Lead Capture System

Name of the Vulnerable Software and Affected Versions: Mortgage Lead Capture System plugin for WordPress versions up to, and including, 8.2.10 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wprequal reset defaults action. This...

CVE-2024-3220 Default mimetype known files writeable on Windows

There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sysctl: Always initialize iuid/igid. iuid/igid is always initialized within the sysfs core, so setownership can safely skip setting them. The commit 5ec27ec735ba from “fs/proc/procsysctl.c: fix the default values of iuid/igid on...

@adhawk/analytics-pixel-loader (>=0.0.2 <=2.0.2), @adhawk/analytics.js-integration-freshdesk (=0.1.0) +143 more potentially affected by CVE-2024-57066 via @ndhoule/defaults (=2.0.1)

@ndhoule/defaults NPM version =2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @ndhoule/defaults and may be impacted: - @adhawk/analytics-pixel-loader =0.0.2, =1.2.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.0, =0.1.0, =1.0.0, =1.1.0 -...

CVE-2024-57066

CVE-2024-57066 targets the @ndhoule/defaults library. The root cause is a prototype pollution in the lib.deep function of v2.0.1, allowing crafted payloads to trigger a Denial of Service (DoS). Public documentation consistently links this to a DoS vector with network access and no user interactio...

defaults 安全漏洞

defaults is a library by the individual developer Nathan Houle. When the value of an enumerable property owned on a source object is undefined, copying that property from the source object to the target object A security vulnerability exists in defaults version v2.0.1, which stems from the lib.de...

PT-2025-5766 · Npm · @Ndhoule/Defaults

Name of the Vulnerable Software and Affected Versions: @ndhoule/defaults version 2.0.1 Description: A prototype pollution in the lib.deep function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. Recommendations: For @ndhoule/defaults version 2.0.1, consider...

CVE-2024-57066

A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

GHSA-29QP-CRVH-W22M Withdrawn Advisory: github.com/hashicorp/yamux's DefaultConfig has dangerous defaults causing hung Read

Withdrawn Advisory This advisory has been withdrawn because further research determined that github.com/hashicorp/yamux was not vulnerable to denial of service in the manner described. This link is maintained to preserve external references. Original Description The default values for...

Smiths Detection HI-SCAN 6040i Hitrax HX-03-19-I 安全漏洞

The Smiths Detection HI-SCAN 6040i Hitrax HX-03-19-I is an entry-level X-ray equipment electronic component from Smiths Detection, UK. A security vulnerability exists in the Smiths Detection HI-SCAN 6040i Hitrax HX-03-19-I that stems from an insecure default configuration that allows an...

Vulnerabilities fixed in Rockwell Automation Power Monitor 1000

Rockwell Automation has fixed vulnerabilities in the Power Monitor 1000. The vulnerabilities are in the API of the Power Monitor 1000, which allows unauthorized users to configure new Policyholder users with high privileges. This allows attackers to edit existing users, create new administrators...

PT-2024-36564 · Kanboard +1 · Kanboard +1

Name of the Vulnerable Software and Affected Versions: Kanboard versions prior to 1.2.43 Description: Kanboard is project management software that focuses on the Kanban methodology. In affected versions, sessions are still usable even though their lifetime has exceeded. Kanboard implements a cust...

The vulnerability of Remote Desktop Services (RDS) for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of Remote Desktop Services RDS for Windows operating systems lies in the default insecure initialization of certain variables. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-51554

Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02...

Red Hat Keycloak 信任管理问题漏洞

Red Hat Keycloak is a suite of software from Red Hat USA that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that stems from sensitive data being embedded as a default value in bytecode or environment...

Google Firebase Js Sdk 安全漏洞

Google Firebase Js Sdk is a client-side codebase for connecting to Firebase back-end services from Google, Inc USA. A security vulnerability exists in Google Firebase Js Sdk that stems from the use of a cookie named FIREBASEDEFAULTS to store configuration data, which allows an attacker to capture...