firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended...

firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended...

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 128.10.0 ESR MFSA 2025-29 bsc1241621: CVE-2025-2817: Potential privilege escalation in Firefox Updater CVE-2025-4082: WebGL shader attribute memory corruption in Firefox for macOS CVE-2025-4083: Process...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2025:1414-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:1414-1 advisory. - Firefox Extended Support Release 128.10.0 ESR MFSA 2025-29 bsc1241621: CVE-2025-2817: Potential privilege escalation in Firefox Updater...

Security update for kernel-livepatch-MICRO-6-0_Update_3

This update for kernel-livepatch-MICRO-6-0Update3 fixes the following issues: CVE-2024-57882: Fixed mptcp: fix TCP options overflow. bsc1235916 CVE-2024-56648: Fixed net: hsr: avoid potential out-of-bound access in fillframeinfo bsc1235452 CVE-2024-50302: Fixed HID: core: zero-initialize the repo...

CVE-2025-32385: Improper Restriction of Rendered UI Layers or Frames

EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbitrary URLs. As the sandbox attribute is not included in the iframe, the remote page can open popups outside of the iframe, potentially tricking users and...

The vulnerability of microprogrammed routing devices with integrated networking services from Cisco ISR 800 and Cisco ISR 1900, microprogrammed access points from Cisco Aironet Access Points (AP) models 1530, 1552, 1570, 1700, 2700, 3700, and microprogrammed wireless industrial access points from Cisco Industrial Wireless 3700, is related to incomplete resource cleanup. This vulnerability allows a malicious actor to trigger service failures.

The vulnerability of microprogrammed routing devices with integrated networking services from Cisco ISR 800 and Cisco ISR 1900, microprogrammed access points from Cisco Aironet models 1530, 1552, 1570, 1700, 2700, 3700, and microprogrammed wireless industrial access points from Cisco Industrial...

CVE-2025-0362: Improper Restriction of Rendered UI Layers or Frames

An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick users into unintentionally authorizing sensitive actions on their behalf...

CVE-2025-21448

Transient DOS may occur while parsing SSID in action frames...

CVE-2025-25213: Improper Restriction of Rendered UI Layers or Frames

Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views and clicks on the content on the malicious page while logged in, unintended operations may be performed...

CVE-2025-21448

Transient DOS may occur while parsing SSID in action frames...

CVE-2025-21448: Buffer Over-read

Transient DOS may occur while parsing SSID in action frames...

PT-2025-15218

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description A transient Denial of Service DOS may occur while parsing SSID in action frames, due to a buffer over-read issue in WLAN firmware. This issue is related to a buffer over-read, which is a type ...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets, which stems from a potential transient denial of service when parsing SSIDs in action frames...

CVE-2025-30356

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures SDLS-EP to secure communications between a spacecraft running the core Flight System cFS and a ground station. In 1.3.3 and earlier, a heap buffer overflow vulnerability persists in...

CVE-2025-30356

CryptoLib (SDLS-EP) vulnerability CVE-2025-30356 affects 1.3.3 and earlier. A heap buffer overflow in Crypto_TC_ApplySecurity results from incomplete validation of the fl (frame length) field; after CVE-2025-29912’s underflow fix, frames can still produce a negative tf_payload_len that is treated...

UBUNTU-CVE-2025-21909

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject cooked mode if it is set along with other flags It is possible to set both MONITORFLAGCOOKFRAMES and MONITORFLAGACTIVE flags simultaneously on the same monitor interface from the userspace. This causes a...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to refuse to set both MONITORFLAGCOOKFRAMES and other flags...

DEBIAN-CVE-2023-52941

In the Linux kernel, the following vulnerability has been resolved: can: isotp: split tx timer into transmission and timeout The timer for the transmission of isotp PDUs formerly had two functions: 1. send two consecutive frames with a given time gap 2. monitor the timeouts for flow control frame...

Security update for buildah

This update for buildah fixes the following issues: CVE-2023-45288: possible excessive CPU consumption due to no limit being set on the number of CONTINUATION frames read for an HTTP/2 request in golang.org/x/net/http2. bsc1236531 CVE-2025-27144: Fixed denial of service in parsing function of...