youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

Description This advisory follows the security advisory GHSA-79w7-vh3h-8g4j published by the yt-dlp/yt-dlp project to aid remediation of the issue in the ytdl-org/youtube-dl project. Vulnerability youtube-dl does not limit the extensions of downloaded files, which could lead to arbitrary filename...

DEBIAN-CVE-2025-22025

In the Linux kernel, the following vulnerability has been resolved: nfsd: put dlstid if fail to queue dlrecall Before calling nfsd4runcb to queue dlrecall to the callbackwq, we increment the reference count of dlstid. We expect that after the corresponding workstruct is processed, the reference...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from nfsd failing to release the dlstid reference count...

[SECURITY] Fedora 41 Update: crosswords-puzzle-sets-xword-dl-0.4.8-1.fc41

Download crossword puzzles for GNOME Crosswords from assorted newspapers using xword-dl...

Fedora 41 : crosswords-puzzle-sets-xword-dl (2025-90f88da466)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-90f88da466 advisory. Update to 0.4.8; Fixes: RHBZ2237964, RHBZ2282129 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

[SECURITY] Fedora 42 Update: crosswords-puzzle-sets-xword-dl-0.4.8-1.fc42

Download crossword puzzles for GNOME Crosswords from assorted newspapers using xword-dl...

CVE-2024-52923

An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Lack of a boundary check during the decoding of DL NAS...

CVE-2025-26585

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DyadyaLesha DL Leadback dl-leadback allows Reflected XSS.This issue affects DL Leadback: from n/a through = 1.2.1...

Linux Distros Unpatched Vulnerability : CVE-2024-38519

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to the fixed versions, yt-dlp and youtube-dl do not limit the extensions of downloaded...

CVE-2025-26585

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DyadyaLesha DL Leadback dl-leadback allows Reflected XSS.This issue affects DL Leadback: from n/a through = 1.2.1...

CVE-2025-26585

CVE-2025-26585 — WordPress plugin DL Leadback is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in versions up to 1.2.1 due to improper input neutralization during web page generation. Public sources (NVD/Red Hat/CVE listings) describe the flaw as DL Leadback: notcapped escalati...

CVE-2025-26585 WordPress DL Leadback Plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound DL Leadback allows Reflected XSS. This issue affects DL Leadback: from n/a through 1.2.1...

CVE-2025-26585 WordPress DL Leadback Plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DyadyaLesha DL Leadback dl-leadback allows Reflected XSS.This issue affects DL Leadback: from n/a through = 1.2.1...

SUSE CVE-2024-38519

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to the fixed versions, yt-dlp and youtube-dl do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp and youtube-...

CVE-2024-57238

Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/procget endpoint. The vulnerability allows an attacker to manipulate SQL queries by injecting malicious SQL code into the orderby parameter...

CVE-2024-57238

Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/procget endpoint. The vulnerability allows an attacker to manipulate SQL queries by injecting malicious SQL code into the orderby parameter...

HPESBHF04774 rev.1 - Certain HPE ProLiant Servers using AMD 3rd Generation and 4th Generation EPYC Processors, AMD-SB-3015, Undermining Integrity Features of SEV-SNP with Memory Aliasing (BadRAM)

Potential Security Impact: Local: Compromise of System Integrity SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL145 Gen11 - Prior to v1.40 HPE ProLiant DL325 Gen11 Server - Prior to v2.30 HPE ProLiant DL345 Gen11 Server - Prior to v2.30 HPE ProLiant DL365 Gen11...

Prolink DL-7203E 安全漏洞

The Prolink DL-7203E is a wireless router from Prolink USA. A security vulnerability exists in the Prolink DL-7203E version V4.0.0B05, which stems from a susceptibility to SQL injection attacks and allows an attacker to manipulate SQL queries by injecting malicious SQL code into the orderby...

RICOH DL Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2012-5002)

Stack-based buffer overflow in SR10 FTP server SR10.exe 1.1.0.6 in Ricoh DC Software DL-10 4.5.0.1, when the Log file name option is enabled, allows remote attackers to execute arbitrary code via a long USER FTP command. This plugin only works with Tenable.ot. Please visit...

Malicious code in all-dl-404 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c81b14656d59125b0a646d87c4351c27ca359a39cbc729ea08ba8ebc5a7e314 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...