DEBIAN-CVE-2025-37845

In the Linux kernel, the following vulnerability has been resolved: tracing: fprobe events: Fix possible UAF on modules Commit ac91052f0ae5 "tracing: tprobe-events: Fix leakage of module refcount" moved trymoduleget from findtracepointmodulecb to findtracepoint caller, but that introduced a...

UBUNTU-CVE-2025-37845

In the Linux kernel, the following vulnerability has been resolved: tracing: fprobe events: Fix possible UAF on modules Commit ac91052f0ae5 "tracing: tprobe-events: Fix leakage of module refcount" moved trymoduleget from findtracepointmodulecb to findtracepoint caller, but that introduced a...

UBUNTU-CVE-2025-37883

In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Add check for getzeroedpage Add check for the return value of getzeroedpage in sclpconsoleinit to prevent null pointer dereference. Furthermore, to solve the memory leak caused by the loop allocation, add a free helper...

U.S. Dept Of Defense: Cross-Site Scripting via 'autoPlay' parameter

A Cross-Site Scripting XSS vulnerability was discovered on a website through the 'autoPlay' parameter in the GET method. Exploitation of this vulnerability allowed the injection of malicious scripts that could be executed. A proof-of-concept was provided demonstrating an alert pop-up...

U.S. Dept Of Defense: Cross-Site Scripting via 'currentImage' parameter

A Cross-Site Scripting XSS vulnerability was discovered on a website from the U.S. Navy through the 'currentImage' parameter in the GET method. The vulnerability allowed for the injection of malicious scripts that could potentially be executed. A proof of concept was provided that demonstrated th...

SUSE CVE-2025-37819

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2mgetfwnode With ACPI in place, gicv2mgetfwnode is registered with the pci subsystem as pcimsigetfwnodecb, which may get invoked at runtime during a PCI host bridge probe. But, the...

SUSE CVE-2025-37831

In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix null-ptr-deref in applesoccpufreqgetrate cpufreqcpugetraw can return NULL when the target CPU is not present in the policy-cpus mask. applesoccpufreqgetrate does not check for this case, which results in a...

The vulnerability of the “org.xwiki.platform:xwiki-platform-wysiwyg-api” component of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability allows an attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the org.xwiki.platform:xwiki-platform-wysiwyg-api component of the XWiki Platform involves redirecting URLs to an unreliable website. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...

CVE-2025-4208

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and including, 8.9.1 via the gettablerecords function. This is due to the unsanitized use of user-supplied input in calluserfunc. This makes it...

DEBIAN-CVE-2025-37830

In the Linux kernel, the following vulnerability has been resolved: cpufreq: scmi: Fix null-ptr-deref in scmicpufreqgetrate cpufreqcpugetraw can return NULL when the target CPU is not present in the policy-cpus mask. scmicpufreqgetrate does not check for this case, which results in a NULL pointer...

UBUNTU-CVE-2025-37819

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2mgetfwnode With ACPI in place, gicv2mgetfwnode is registered with the pci subsystem as pcimsigetfwnodecb, which may get invoked at runtime during a PCI host bridge probe. But, the...

WordPress plugin NEX-Forms 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

Netis Systems WF2220 安全漏洞

Netis Systems WF2220 is a wireless USB network card from Netis Systems. A security vulnerability exists in the Netis Systems WF2220 version 1.2.31706, which originates from the /cgi-bin-igd/netcoreget.cgi endpoint that returns the device configuration, including the password in clear text, to an...

RLSA-2024:11189 Moderate: python3.11-urllib3 security update

The python-urllib3 package provides the Python HTTP module with connection pooling and file POST abilities. Security Fixes: urllib3: Request body not stripped after redirect from 303 status changes request method to GET CVE-2023-45803 For more details about the security issues, including the...

scanner has a Public API without sufficient bounds checking

Match::get and Match::ptr lack sufficient bounds checks, leading to potential out of bounds reads...

SUSE CVE-2022-49871

In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix memory leaks of napigetfrags kmemleak reports after running testprogs: unreferenced object 0xffff8881b1672dc0 size 232: comm "testprogs", pid 394388, jiffies 4354712116 age 841.975s hex dump first 32 bytes: e0 84 d7...

CVE-2025-45611

Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET request...

Lack of sufficient checks in public API

The following functions in the anon-vec crate are unsound due to insufficient checks on their arguments:: - AnonVec::getref - AnonVec::getmut - AnonVec::removeget The crate was built as a learning project and is not being maintained...

SUSE CVE-2022-49787

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-pci: Fix possible memory leak caused by missing pcidevput pcigetdevice will increase the reference count for the returned pcidev. We need to use pcidevput to decrease the reference count before amdprobe returns. There ...

WordPress plugin Search Exclude 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...