The vulnerability of the Cloud Files Mini Filter Driver for operating systems Windows allows attackers to increase their privileges.

The vulnerability of the Cloud Files Mini Filter Driver for Windows operating systems is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain increased privileges...

EUVD-2023-60011

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9kwmirspcallback Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9kwmicmd. The callback writes...

CVE-2025-11750

In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system...

CVE-2022-50577

In the Linux kernel, the following vulnerability has been resolved: ima: Fix memory leak in imainodehash Commit f3cc6b25dcc5 "ima: always measure and audit files in policy" lets measurement or audit happen even if the file digest cannot be calculated. As a result, iint-imahash could have been...

CVE-2022-50565

In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: fix potential memory leak in lfxusbenablerx urbs does not be freed in exception paths in lfxusbenablerx. That will trigger memory leak. To fix it, add kfree for urbs within "error" label. Compile tested only...

CVE-2025-11750 User Enumeration via Distinct Error Messages in langgenius/dify-web

In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system...

CVE-2025-11750 User Enumeration via Distinct Error Messages in langgenius/dify-web

In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system...

CVE-2025-11750

CVE-2025-11750 affects langgenius/dify-web version 1.6.0. Multiple connected sources confirm an authentication flaw where login/registration error messages distinguish between non-existent vs. existing usernames or emails (e.g., “account not found”), enabling user enumeration. This can facilitate...

dify 安全漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in version 1.6.0 of dify, which stems from the authentication mechanism returning different error messages for non-existing and existing accounts, potentially leading to an...

CVE-2025-61301

Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 commit 52e4b43, on 2025-05-17 allows attackers who can submit samples to cause incomplete or missing behavioral analysis reports by generating deeply nested or oversized behavior data that trigger MongoDB BSON limits o...

EUVD-2022-55000

In the Linux kernel, the following vulnerability has been resolved: net: asix: add proper error handling of usb read errors Syzbot once again hit uninit value in asix driver. The problem still the same -- asixreadcmd reads less bytes, than was requested by caller. Since all read requests are...

The vulnerability of Moxa’s network device software-related microprogramming systems, related to errors in privilege management, allows attackers to escalate their privileges.

The vulnerability of Moxa network device software-based microprograms is related to errors in privilege management. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

The vulnerability of the `recv_msg_userauth_request()` function in the `svr-auth.c` file of the SSH Dropbear session management software allows a hacker to gain unauthorized access to protected information.

The vulnerability of the recvmsguserauthrequest function in the svr-auth.c file of the SSH Dropbear session management software is related to errors in processing information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987683)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987683 advisory. In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix struct clk leak on probe errors Make sure to release the pipe clock reference ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987703)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987703 advisory. In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix reset-controller leak on probe errors Make sure to release the lane reset...

EUVD-2025-35111

Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 commit 52e4b43, on 2025-05-17 allows attackers who can submit samples to cause incomplete or missing behavioral analysis reports by generating deeply nested or oversized behavior data that trigger MongoDB BSON limits o...

CVE-2025-61301

Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 commit 52e4b43, on 2025-05-17 allows attackers who can submit samples to cause incomplete or missing behavioral analysis reports by generating deeply nested or oversized behavior data that trigger MongoDB BSON limits o...

PT-2025-42814

Name of the Vulnerable Software and Affected Versions CAPEv2 versions prior to commit 52e4b43 on 2025-05-17 Description The software contains a flaw that allows attackers who can submit samples to cause incomplete or missing behavioral analysis reports. This occurs by generating deeply nested or...

The vulnerability of Microsoft Defender for Endpoint, related to synchronization errors when using a shared resource (“Race Situation”), allows a perpetrator to trigger a service failure.

The vulnerability of Microsoft Defender for Endpoint on Linux operating systems is related to synchronization errors when using a shared resource “Race Condition”. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2025-61301: Uncontrolled Resource Consumption

Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 commit 52e4b43, on 2025-05-17 allows attackers who can submit samples to cause incomplete or missing behavioral analysis reports by generating deeply nested or oversized behavior data that trigger MongoDB BSON limits o...