PT-2025-6707 · Nothing Tech · Nothing Os

Name of the Vulnerable Software and Affected Versions: Nothing Tech Nothing OS version 2.6 Description: The issue allows a local attacker to escalate privileges via the NtBpfService component. Recommendations: For Nothing Tech Nothing OS version 2.6, at the moment, there is no information about a...

gcc-toolset-13-gcc security update

13.3.1-2.2.0.1 - Merge Oracle patches to 13.3.1-2.2. gfortran needs install-info at installation time. Orabug: 36472775 13.3.1-2.2 - disable jQuery use, don't ship jquery.js CVE-2020-11023, RHEL-78279...

PT-2025-7054

Name of the Vulnerable Software and Affected Versions: mailcow: dockerized versions prior to 2025-01a Description: A vulnerability in the password reset functionality of mailcow allows an attacker to manipulate the Host HTTP header to generate a password reset link pointing to an...

PT-2025-6850 · Code Projects · Code-Projects Wazifa System

Name of the Vulnerable Software and Affected Versions: code-projects Wazifa System version 1.0 Description: A vulnerability was found in the processing of the file /Profile.php, where the manipulation of the postcontent argument leads to cross-site scripting. The attack may be initiated remotely...

gcc-toolset-13-gcc security update

13.3.1-2.2.0.1 - Merge Oracle patches to 13.3.1-2.2. Oracle history: November-20-2024 Qing Zhao 13.3.1-2.1.0.1 - gfortran needs install-info at installation time. Orabug: 36472775 13.3.1-2.2 - disable jQuery use, don't ship jquery.js CVE-2020-11023, RHEL-78378...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - spi: rockchip: Fixed improper handling of runtime PM/system PM operations. The commit e882575efc77 “spi: rockchip: Suspend and resume the bus during NOIRQSYSTEMSLEEPPM ops” no longer respects the runtime PM status and simply...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: pci/hotplug/pnvphp: Fixed the hotplug driver crash on Powernv The hotplug driver for powerpc pci/hotplug/pnvphp.c causes a kernel crash when attempting to hot-unplug or disable the PCIe switch/bridge from the PHB. The crash occur...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ila: blocking BH in ilaoutput As explained in commit 1378817486d6 “tipc: blocking BH before using dstcache”, the net/core/dstcache.c helper functions need to be called with blocking BH disabled. ilaoutput is called from...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: Do not prepare/unprepare the clock during runtime suspend/resume If there is any clock controller attached to this I2C bus controller, such as Versaclock or an AIC32x4 I2C codec, then an I2C transfer triggered by th...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: Fixed the issue where quota root leaks after quota disabling fails. If, during quota disabling, we fail to clean the quota tree or delete the root node from the root tree, we jump to the ‘out’ label without ever...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: fixed the f2fsbugon when uninstalling the filesystem, specifically the call to f2fsevict inode. Creating large files during the checkpoint disabling period results in insufficient free segments. When writing back the root...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: fec: removed .ndopollcontroller to avoid deadlocks. A deadlock issue was found in the sungem driver. Please refer to the commit ac0a230f719b “eth: sungem: removed .ndopollcontroller to avoid deadlocks”. The root cause of the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/lima: Fix for shared interrupt handling during driver removal. lima uses a shared interrupt; therefore, the interrupt handlers must be prepared to be called at any time. During driver removal, the clocks are disabled early, a...

SUSE CVE-2024-57949

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Don't enable interrupts in itsirqsetvcpuaffinity The following call-chain leads to enabling interrupts in a nested interrupt disabled section: irqsetvcpuaffinity irqgetdesclock rawspinlockirqsave --- Disable...

PT-2025-18398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel related to the backlight LED driver. The issue occurs when the led sysfs enable function is called without holding the led access...

PT-2025-6252

Name of the Vulnerable Software and Affected Versions: Distribution versions 3.0.0-beta.1 through 3.0.0-rc.2 Description: The issue lies in how the JSON web key JWK verification is performed. When a JSON web token JWT contains a JWK header without a certificate chain, the code only checks if the...

PT-2025-6192 · WordPress · Geodirectory – Wp Business Directory Plugin

Name of the Vulnerable Software and Affected Versions: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions up to, and including, 2.8.97 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitizati...

kernel security update

5.14.0-503.23.25.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

PT-2025-6121 · Lumsoft · Lumsoft Erp

Name of the Vulnerable Software and Affected Versions: Lumsoft ERP version 8 Description: A critical issue was found in the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack...

PT-2025-6067 · Unknown +2 · Pam Pkcs11 +2

Name of the Vulnerable Software and Affected Versions: PAM-PKCS11 versions 0.6.12 and prior Description: The issue affects a Linux-PAM login module that allows X.509 certificate-based user login. When a user presses ctrl-c/ctrl-d while being asked for a PIN, the pam pkcs11 module segfaults...