Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2025-1721)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux Distros Unpatched Vulnerability : CVE-2025-7700

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FFmpeg's ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when...

Linux Distros Unpatched Vulnerability : CVE-2022-49842

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: core: Fix use-after-free in sndsocexit KASAN reports a use-after-free: BUG: KASAN: use-after- free in devicedel+0xb5b/0xc60 Read of size 8 at addr...

Linux Distros Unpatched Vulnerability : CVE-2017-6381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default...

Linux Distros Unpatched Vulnerability : CVE-2024-55636

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0...

Linux Distros Unpatched Vulnerability : CVE-2017-5648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to...

Rtpengine mr13.4.1.1 Injection / Redirection

Rtpengine starting at version mr13.4.1.1 allows for redirection to an attacker-controlled host and insertion of arbitrary RTP packet into active calls...

CLSA-2025-1753799668 Fix CVE(s): CVE-2025-32462

SECURITY UPDATE: unauthorized commands execution on unintended hosts - debian/patches/CVE-2025-32462.patch: restrict user from setting remote host for command unless listing privileges - CVE-2025-32462...

Malicious code in react-redux-stylizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a197696811f0bf0075aceaf1c780dc72528144a4fa028d9dabdc7f6999144f42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-8283 Netavark: podman: netavark may resolve hostnames to unexpected hosts

A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be us...

Malicious code in style-postprocessor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25f023d8b7876e055cebe61a886a5fea11ea9b7c8eaeda3468cc1b18e27dfbe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in scheduler-experimental-builtin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5c381d132dddf957ca46bcbb357f4d138089323733e00e65f2e13d7ac84fc23 Any computer that has this package installed or running should be considered...

NewStart CGSL MAIN 7.02 : bluez Vulnerability (NS-SA-2025-0149)

The remote NewStart CGSL host, running version MAIN 7.02, has bluez packages installed that are affected by a vulnerability: - Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports,...

Fire Ant Exploits VMware Flaws to Compromise ESXi Hosts and vCenter Environments

Virtualization and networking infrastructure have been targeted by a threat actor codenamed Fire Ant as part of a prolonged cyber espionage campaign. The activity, observed this year, is primarily designed Now to infiltrate organizations' VMware ESXi and vCenter environments as well as network...

Malicious code in aspida-lsd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acc2eb7e748df3c152fd014eb7b9ff3d3933451500a1ef3fd8af63811ed846de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Access Control Bypass

Apache HTTP Server modssl is vulnerable to Access control bypass. The vulnerability is due to improper handling of TLS 1.3 session resumption across multiple virtual hosts with different trusted client certificate configurations, which allows an attacker with a trusted certificate for one virtual...

BIT-APACHE-2025-23048 Apache HTTP Server: mod_ssl access control bypass with session resumption

In some modssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when modssl is configured for multiple virtual hosts, with each restricted to a different set of...

CVE-2025-34105

A stack-based buffer overflow vulnerability exists in the built-in web interface of DiskBoss Enterprise versions 7.4.28, 7.5.12, and 8.2.14. The vulnerability arises from improper bounds checking on the path component of HTTP GET requests. By sending a specially crafted long URI, a remote...

CVE-2025-34105 DiskBoss Enterprise Stack-Based Buffer Overflow RCE

A stack-based buffer overflow vulnerability exists in the built-in web interface of DiskBoss Enterprise versions 7.4.28, 7.5.12, and 8.2.14. The vulnerability arises from improper bounds checking on the path component of HTTP GET requests. By sending a specially crafted long URI, a remote...

CVE-2025-34105

DiskBoss Enterprise (versions 7.4.28, 7.5.12, 8.2.14) contains a stack-based buffer overflow in its built-in web interface due to improper bounds checking on the path component of HTTP GET requests. A remote, unauthenticated attacker can trigger a long URI to cause the overflow, potentially execu...