PT-2025-13884 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.4 Description: The issue allows an app to potentially modify protected parts of the file system due to insufficient validation of environment variables. Recommendations: For versions prior to 15.4, update to macOS...

The vulnerability of the operating environment for managing and maintaining the Dell Unity Operating Environment (DELL Unity OE) lies in the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to enhance their privileges and execute arbitrary commands.

The vulnerability of the Dell Unity Operating Environment’s operating environment for data storage management and operation is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow attackers to enhance...

The vulnerability of the operating environment for managing and maintaining the Dell Unity Operating Environment (DELL Unity OE) lies in the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to enhance their privileges and execute arbitrary commands.

The vulnerability of the Dell Unity Operating Environment’s operating environment for data storage management and operation is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow attackers to enhance...

The vulnerability of the operating environment for managing and maintaining the Dell Unity Operating Environment (DELL Unity OE) lies in the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to enhance their privileges and execute arbitrary commands.

The vulnerability of the Dell Unity Operating Environment’s operating environment for data storage management and operation is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow attackers to enhance...

The vulnerability of the audio_element_obu() function in the libavformat library of the Ffmpeg multimedia environment allows a hacker to induce a service failure.

The vulnerability of the audioelementobu function in the libavformat library of the Ffmpeg multimedia environment is related to improper memory release before deleting the last reference „memory leak“ when processing the numparameters parameter. Exploiting this vulnerability can allow an attacker...

CVE-2025-30348 affecting package qtbase for versions less than 6.6.3-3

CVE-2025-30348 affecting package qtbase for versions less than 6.6.3-3. A patched version of the package is available...

[SECURITY] Fedora 41 Update: nodejs-nodemon-3.1.9-3.fc41

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does...

SUSE CVE-2025-21871

In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix supplicant wait loop OP-TEE supplicant is a user-space daemon and it's possible for it be hung or crashed or killed in the middle of processing an OP-TEE RPC call. It becomes more complicated when there is incorre...

CVE-2025-30222

Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of...

grub2: net: Out-of-bounds write in grub_net_search_config_file()

A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grubstrcpy function. During this step, it fails to consider the environment variable length...

netty: Denial of Service attack on windows app using Netty

A flaw was found in Netty. An unsafe reading of the environment file could potentially cause a denial of service. When loaded on a Windows application, Netty attempts to load a file that does not exist. If an attacker creates a large file, the Netty application crashes...

netty: Denial of Service attack on windows app using Netty

A flaw was found in Netty. An unsafe reading of the environment file could cause a denial of service. When loaded on a Windows application, Netty attempts to load a file that does not exist. If an attacker creates a large file, the Netty application crash...

netty: Denial of Service attack on windows app using Netty

A flaw was found in Netty. An unsafe reading of the environment file could cause a denial of service. When loaded on a Windows application, Netty attempts to load a file that does not exist. If an attacker creates a large file, the Netty application crash...

netty: Denial of Service attack on windows app using Netty

A flaw was found in Netty. An unsafe reading of the environment file could potentially cause a denial of service. When loaded on a Windows application, Netty attempts to load a file that does not exist. If an attacker creates a large file, the Netty application crashes...

SUSE CVE-2022-1804

accountsservice no longer drops permissions when writting .pamenvironment...

uberAgent shows no data is being found for the Citrix Cloud environment

uberAgent logging shows no errors for connectivity to Citrix Cloud, but shows that no data about the environment is being found. 2025-03-12 10:00:50.000 -0400,DEBUG,ORG,HOSTNAME,2264,GetInformation,No Citrix site information found.2025-03-12 10:00:50.000...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-900)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-900 advisory. The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potential...

CLSA-2025-1743011981 postgresql: Fix of CVE-2024-10979

CVE-2024-10979: fix incorrect control of environment variables in PostgreSQL PL/Perl...

CVE-2025-30353 Directus's webhook trigger flows can leak sensitive data

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the A...

Shescape has potential environment variable exposure on Windows with CMD

Impact This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of quote/quoteAll/escape/escapeAll. An attacker may be able to get read-only access to environment variables. Example: javascript import as cp from "node:childprocess"; import...