5740 matches found
CVE-2025-64186 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves
Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...
EUVD-2025-131929
Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...
Evervault Go SDK 数据伪造问题漏洞
Evervault Go SDK is an open source development toolkit from Evervault. A Data Forgery Issue vulnerability exists in Evervault Go SDK versions prior to 1.3.2, which stems from incomplete validation logic that could lead to trusting an enclave operator that does not meet integrity guarantees...
PT-2025-46337
A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing the users password. This vulnerability occurs when MFA is enabled but not completed within a 7-day period...
PT-2025-46155
Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2025.3.104432 Description A flaw exists in JetBrains YouTrack where incomplete user principal cleanup can result in the reuse of an incorrect authorization context. Recommendations Update to version...
Persistent Temp-File incomplete cleanup / resource exhaustion in `transformers` Serve
Description The transformers OpenAI-compatible server leaks every base64 image it decodes to disk. Because the temporary files are never cleaned up, an attacker can exhaust disk space by repeatedly calling /v1/chat/completions with base64 imageurl entries. Vulnerable Code In...
Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : runC vulnerabilities (USN-7851-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7851-1 advisory. Lei Wang and Li Fubang discovered that runC incorrectly handled masked paths. An attacker could possibly replace a container'...
CVE-2025-64163 DataEase's DB2 is vulnerable to SSRF
DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. However, omission of protection for the dns:// protocol results in an SSRF vulnerability. This issue is fixed in version 2.10.15...
USN-7851-1 runc-app, runc-stable vulnerabilities
Lei Wang and Li Fubang discovered that runC incorrectly handled masked paths. An attacker could possibly replace a container's /dev/null with a symlink to some other procfs file and possibly escape a container. CVE-2025-31133 Lei Wang and Li Fubang discovered that runC incorrectly handled the...
Insertion of Sensitive Information into Externally-Accessible File or Directory
Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Insertion of Sensitive Information into Externally-Accessible File or Directory due to incomplete masking of OCI secret fields in responses from the /models and /v1/models...
The vulnerability of the automountfullpath() function in the Linux operating system allows a hacker to trigger a service failure.
The vulnerability of the automountfullpath function fs/smb/client/namespace.c in the Linux kernel stems from incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability could allow an attacker to cause a service failure...
Siemens SIMATIC Devices Observable Discrepancy (CVE-2024-0553)
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange,...
SUSE-SU-2025:3844-1 Security update for ImageMagick
This update for ImageMagick fixes the following issues: - CVE-2025-62171: Fixed incomplete fix for integer overflow in BMP Decoder bsc1252282...
GHSA-9PP9-CFWX-54RM ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
Summary CVE-2025-57803 claims to be patched in ImageMagick 7.1.2-2, but the fix is incomplete and ineffective. The latest version 7.1.2-5 remains vulnerable to the same integer overflow attack. The patch added BMPOverflowCheck but placed it after the overflow occurs, making it useless. A maliciou...
ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
Summary CVE-2025-57803 claims to be patched in ImageMagick 7.1.2-2, but the fix is incomplete and ineffective. The latest version 7.1.2-5 remains vulnerable to the same integer overflow attack. The patch added BMPOverflowCheck but placed it after the overflow occurs, making it useless. A maliciou...
PT-2025-44187
Name of the Vulnerable Software and Affected Versions Wazuh affected versions not specified Description A time-of-check/time-of-use TOCTOU race condition exists in the File Integrity Monitoring FIM component when automatic threat removal is enabled. This can allow a local, low-privileged attacker...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not properly checking the copytoiter return value, which could result in incomplete data copying...
Siemens SIMATIC Devices Incomplete Cleanup (CVE-2024-50148)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix wild-memory-access in protounregister As bnepinit ignore bnepsockinit's return value, and bnepsockinit will cleanup all resource. Then when remove bnep module will call bnepsockcleanup to cleanup sock's...
EulerOS 2.0 SP13 : iputils (EulerOS-SA-2025-2263)
According to the versions of the iputils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ping in iputils before 20250602 allows a denial of service application error in adaptive ping mode or incorrect data collection via a crafted ICMP...