CVE-2025-54791 OMERO.web displays unecessary user information when requesting to reset the password

OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been...

K000152964: OpenSSH vulnerability CVE-2025-32728

Security Advisory Description In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding. CVE-2025-32728 Impact This vulnerability could lead to exploit of the X11 server, which may allow unintended access...

PT-2025-33071 · Unknown · Kuwfi Gc111-Gl-Lm321 V3.0 20191211 +1

Name of the Vulnerable Software and Affected Versions: KuWFi GC111 GC111-GL-LM321 V3.0 20191211 Description: The TELNET service is enabled by default and exposed over the WAN interface without authentication. Recommendations: Disable the TELNET service to prevent unauthorized access...

PT-2025-33052 · Unknown · Hortusfox-Web

Name of the Vulnerable Software and Affected Versions: hortusfox-web version 4.4 Description: A zip slip vulnerability exists in the /modules/ImportModule.php component. This allows attackers to execute arbitrary code by using a crafted archive. Recommendations: Update to a newer version that...

PT-2025-37952

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the drm/mediatek subsystem related to handling of the old state-crtc after a hotplug event. Specifically, a lack of error handling can lead to a kerne...

CVE-2025-43982

Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default. There is a hidden hard-coded root account that cannot be disabled in the GUI...

PT-2025-32994

Name of the Vulnerable Software and Affected Versions: OMERO.web versions prior to 5.29.2 Description: OMERO.web provides a web-based client and plugin infrastructure. If an error occurred when resetting a user's password using the Forgot Password option, the error message displayed on the webpag...

Prototype Pollution

Overview org.webjars.npm:content-security-policy-parser is a Parse Content Security Policy directives. Affected versions of this package are vulnerable to Prototype Pollution via the parse function. An attacker can manipulate the Object prototype by supplying a crafted policy name in HTTP queries...

GHSA-W2CQ-G8G3-GM83 content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE

Impact A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if you provide a policy name called proto you can override the Object prototype. For example: const parse = require'content-security-policy-parser'; const x = parse"default-src 'self'; proto foobar";...

Prototype Pollution

Overview content-security-policy-parser is a Parse Content Security Policy directives. Affected versions of this package are vulnerable to Prototype Pollution via the parse function. An attacker can manipulate the Object prototype by supplying a crafted policy name in HTTP queries, potentially...

content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE

Impact A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if you provide a policy name called proto you can override the Object prototype. For example: const parse = require'content-security-policy-parser'; const x = parse"default-src 'self'; proto foobar";...

CVE-2025-55164

content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called proto, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves...

CVE-2025-55164 content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE

content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called proto, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves...

CVE-2025-55164

The vulnerability CVE-2025-55164 affects the content-security-policy-parser library. A prototype pollution flaw exists in versions ≤0.5.0 when a policy name of proto is provided, enabling override of Object.prototype. A fix is available in version 0.6.0 and later; remediation is to upgrade to 0.6...

CVE-2025-55164 content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE

content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called proto, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves...

PT-2025-32688 · Unknown +1 · Content-Security-Policy-Parser +1

Name of the Vulnerable Software and Affected Versions: content-security-policy-parser versions 0.5.0 and earlier Description: The content-security-policy-parser software parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, where...

Linux Distros Unpatched Vulnerability : CVE-2022-49841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: serial: imx: Add missing .thawnoirq hook The following warning is seen with non-console UART...

Linux Distros Unpatched Vulnerability : CVE-2022-50053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iavf: Fix reset error handling Do not call iavfclose in iavfresettask error handling. Doing so can lead to double call of napidisable, which can lead to deadloc...

PT-2025-35990

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition was identified in the kcm unattach function within the kernel's networking subsystem. Specifically, the function lacked a check of the kcm-tx stopped flag before calling...

Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2025-1937)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...