Debian dla-4160 : libbson-xs-perl - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4160 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4160-1 [email protected]...

Ensure That Different Group IDs Are Initially Assigned to Different Users

The initial login groups of different users must be different. If a user needs to access files in another group, you need to run a command to add the user to the group. In most cases, if the file permission and the folder permission are set to 640 and 750, respectively, users in the same group ca...

Qualcomm Chipsets 输入验证错误漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. An input validation error vulnerability exists in Qualcomm Chipsets that stems from a memory corruption when fetching and updating IOCTL during IFE output resource ID validation...

DEBIAN-CVE-2022-49790

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - invert valid length check when fetching device IDs syzbot is reporting uninitialized value at iforceinitdevice 1, for commit 6ac0aec6b0a6 "Input: iforce - allow callers supply data buffer when fetching device IDs"...

CVE-2022-49790

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - invert valid length check when fetching device IDs syzbot is reporting uninitialized value at iforceinitdevice 1, for commit 6ac0aec6b0a6 "Input: iforce - allow callers supply data buffer when fetching device IDs"...

CVE-2022-49790: Use of Uninitialized Resource

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - invert valid length check when fetching device IDs syzbot is reporting uninitialized value at iforceinitdevice 1, for commit 6ac0aec6b0a6 "Input: iforce - allow callers supply data buffer when fetching device IDs"...

[SECURITY] [DLA 4147-1] fig2dev security update

Debian LTS Advisory DLA-4147-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin April 30, 2025 https://wiki.debian.org/LTS Package : fig2dev Version : 1:3.2.8-3+deb11u3 CVE ID : CVE-2025-46397 CVE-2025-46398 CVE-2025-46399 CVE-2025-46400 Multiple vulnerabilities wer...

@astrobase/core (>=0.2.0, <=0.4.0), @indiebackend/domain-ids (>=0.0.1, <=1.0.3) +2 more potentially affected by CVE-2025-27611 via base-x (5.0.0)

base-x NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on base-x and may be impacted: - @astrobase/core =0.2.0, =0.0.1, =0.0.11, =0.5.0, =0.5.15 Source cves: CVE-2025-27611 Source advisory: OSV:GHSA-XQ7P-G2VC-G82P...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation Fixes for April 2024.

Summary In addition to OS level package updates, multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.3-IF032 and 23.0.2-IF004. Vulnerability Details CVEID:CVE-2024-22353 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is...

Debian dla-4134 : fig2dev - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4134 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4134-1 [email protected]...

CVE-2025-27565

An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs...

CVE-2025-3495 COMMGR - Insufficient Randomization Authentication Bypass

Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs CWE-338. An attacker could easily brute force a session ID and load and execute arbitrary code...

CVE-2025-3495

CVE-2025-3495 affects Delta Electronics COMMGR v1 and v2. The root cause is insufficiently randomized session IDs (CWE-338) in COMMGR, allowing brute-force traversal to load and execute arbitrary code. Several connected sources corroborate this issue, including CVE entries and PT Security notes r...

ejabberd -- mod_muc_occupantid: Fix handling multiple occupant-id

ejabberd team reports: Fixed issue with handling of user provided occupant-id in messages and presences sent to muc room. Server was replacing just first instance of occupant-id with its own version, leaving other ones untouched. That would mean that depending on order in which clients send...

Delta Electronics COMMGR (Update A)

RISK EVALUATION Successful exploitation of this vulnerability could allow for an attacker to remotely access the AS3000Simulator family in the COMMGR software and execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation...

Photon OS 4.0: Curl PHSA-2025-4.0-0774

An update of the curl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0774. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Debian dsa-5900 : affs-modules-6.1.0-28-4kc-malta-di - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5900 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5900-1 [email protected] https://www.debian.org/securit...

Advisory ROSA-SA-2025-2830

Software: golang 1.19.13 OS: ROSA Virtualization 3.0 packageevrstring: golang-1.19.13-2.rv30 CVE-ID: CVE-2023-29402 BDU-ID: 2023-03201 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Cgo module of the Go programming language is related to incorrect code generation control when handling directory...

Advisory ROSA-SA-2025-2789

Software: java-11-openjdk 11.0.25.0.9 OS: rosa-server79 packageevrstring: java-11-openjdk-11.0.25.0.9-1.0.1.res7 CVE-ID: CVE-2024-21208 BDU-ID: 2024-11501 CVE-Crit: LOW CVE-DESC.: A vulnerability in the Diagnostics components of Oracle GraalVM Enterprise Edition virtual machines, Oracle GraalVM f...

ALSA-2025:3772 Moderate: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints CVE-2024-45341 golang: net/http: net/http: sensitive headers incorrectly sent after...