SUSE-SU-2025:02976-1 Security update for cmake3

This update for cmake3 fixes the following issues: - CVE-2025-9301: Fixed assertion failure due to improper validation bsc1248461...

Security update for cmake3

This update for cmake3 fixes the following issues: CVE-2025-9301: Fixed assertion failure due to improper validation bsc1248461 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...

SUSE-SU-2025:02975-1 Security update for cmake3

This update for cmake3 fixes the following issues: - CVE-2025-9301: Fixed assertion failure due to improper validation bsc1248461...

CVE-2025-20131

A vulnerability in the GUI of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy function. An attacker could exploit this...

Cisco Identity Services Engine (cisco-sa-ise-file-upload-qksX6C8g)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the GUI of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to...

WordPress plugin Soledad 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

CVE-2025-55198 Helm May Panic Due To Incorrect YAML Content

Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expect...

Linux Distros Unpatched Vulnerability : CVE-2023-40477

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the create channel subscription endpoint when unexpected request bodies are not properly handled. An attacker can cause the plugin to crash by repeatedly sending invalid request bodies...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the create channel subscription endpoint when unexpected request bodies are not properly handled. An attacker can cause the plugin to crash by repeatedly sending invalid request bodies...

CVE-2025-27075

CVE-2025-27075 affects Bluetooth Host on Qualcomm chipsets and involves memory corruption when processing IOCTL commands with larger buffers. Root cause cited is improper handling/validation related to large IOCTL buffers (description aligns with an array/index validation issue). Impact per avail...

CVE-2025-27067 Improper Validation of Array Index in DSP Service

Memory corruption while processing DDI call with invalid buffer...

(Pwn2Own) Lorex 2K Indoor Wi-Fi Security Camera Improper Validation of Array Index Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of requests sent to TCP port 9876. The...

(Pwn2Own) Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Tesla Wall Connector devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the HTTP Content-Length header. The issue results...

Local File Inclusion (LFI)

Dagster is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper validation of the notebookpath field in ExternalNotebookData requests, which allows an attacker to perform path traversal and read arbitrary files by bypassing the intended extension-based check...

Server Side Request Forgery (SSRF)

com.xuxueli, xxl-job-core is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation in the httpJobHandler function of SampleXxlJob.java, which allows an attacker to send crafted requests to internal or external systems remotely...

CVE-2025-4295

Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting. This issue affects B2B: before 04.06.2025...

Improper Access Control

org.apache.jena, jena-fuseki is vulnerable to improper access control. The vulnerability is due to insufficient validation or restriction on file path locations when administrators create database files in Apache Jena, allows creation of files outside the intended directory structure...

Path Traversal

org.dspace, dspace-api is vulnerable to path traversal. The vulnerability is due to improper validation of file paths in the Simple Archive Format SAF importer, which allows an attacker to craft a malicious SAF package referencing arbitrary system files...

CVE-2025-6232

An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying specific registry locations...