CVE-2025-32012

Summary: CVE-2025-32012 affects Jellyfin versions 10.9.0 through 10.10.6, where the "/System/Restart" admin endpoint can be spoofed to restart the server by unauthenticated attackers on the same LAN, due to how the source IP is determined. Impact: Unauthenticated DoS against default-configured Je...

CVE-2025-32012 Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing

Jellyfin is an open source self hosted media server. In versions 10.9.0 to before 10.10.7, the /System/Restart endpoint provides administrators the ability to restart their Jellyfin server. This endpoint is intended to be admins-only, but it also authorizes requests from any device in the same...

CLSA-2025-1744721593 c-ares: Fix of 4 CVEs

CVE-2024-25629: fix invalid memory read issue in aresreadline - CVE-2023-31130: fix buffer underflow in aresinetnetpton for certain ipv6 addresses - CVE-2023-31147: fix issue of using weak random numbers in DNS query ids by replacing rand with a modern OS-provided CSPRNG like arc4random -...

Security Bulletin: IBM Aspera Shares is vulnerable to multiple medium vulnerabilities (CVE-2024-38317, CVE-2024-56470, CVE-2024-38316, CVE-2024-56473, CVE-2024-56472, CVE-2024-56471, CVE-2024-38318)

Summary This Security Bulletin addresses multiple medium severity vulnerabilities that have been remediated in IBM Aspera Shares 1.10.0 PL7. Vulnerability Details CVEID:CVE-2024-38317 DESCRIPTION: IBM Aspera Shares is vulnerable to cross-site scripting. This vulnerability allows a privileged user...

Security Bulletin: AIX is vulnerable to denial of service (CVE-2024-47102, CVE-2024-52906)

Summary Vulnerabilities in the AIX TCP/IP and perfstat kernel extensions may lead to a denial of service CVE-2024-47102, CVE-2024-52906. Vulnerability Details CVEID:CVE-2024-47102 DESCRIPTION: IBM AIX could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel...

PT-2025-28584 · Microsoft · Windows Tcp/Ip +1

Name of the Vulnerable Software and Affected Versions: Windows TCP/IP affected versions not specified Description: The issue is related to a null pointer dereference in Windows TCP/IP, which allows an authorized attacker to elevate privileges locally. This means an attacker with existing access t...

PT-2025-16394 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions 10.9.0 through 10.10.6 Description: The issue affects Jellyfin, an open source self-hosted media server. It involves the /System/Restart endpoint, which is intended for administrators to restart the Jellyfin server. However,...

AIX : Multiple Vulnerabilities (IJ52421)

The version of AIX installed on the remote host is prior to APAR IJ52421. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ52421 advisory. - IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel...

AIX : Multiple Vulnerabilities (IJ52978)

The version of AIX installed on the remote host is prior to APAR IJ52978. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ52978 advisory. - IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel...

AIX : Multiple Vulnerabilities (IJ52366)

The version of AIX installed on the remote host is prior to APAR IJ52366. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ52366 advisory. - IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel...

Ivanti Connect Secure 22.7R2.5 - Remote Code Execution (RCE)

Exploit Title: Ivanti Connect Secure 22.7R2.5 - Remote Code Execution RCE Date: 2025-01-11 Exploit Author: @absholi7ly CVE: CVE-2025-0282 import requests import sys import struct import socket import ssl import urllib3 import time Disable SSL warnings...

Jellyfin 安全漏洞

Jellyfin is a free software media system from Jellyfin Open Source. It allows you to control the management and streaming of media. It is an alternative to the proprietary Emby and Plex for serving media from dedicated servers to end-user devices through multiple applications. A security...

F5 Networks BIG-IP : BIND vulnerability (K000150814)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10.8 / 16.1.6.1 / 17.1.3 / 17.5.1.3. It is, therefore, affected by a vulnerability as referenced in the K000150814 advisory. It is possible to construct a zone such that some queries to it will generate responses...

The vulnerability of the BIG-IP Access Policy Manager, as well as software solutions such as BIG-IP Advanced Firewall Manager, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Domain Name System, BIG-IP Link Controller, BIG-IP Local Traffic Manager, BIG-IP Policy Inforcement Manager, BIG-IQ Centralized Management, lies in the lack of measures taken to perform data cleaning at the management level. This allows attackers to circumvent existing security restrictions.

The vulnerabilities of the BIG-IP Access Policy Manager, as well as of other software solutions such as BIG-IP Advanced Firewall Manager, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Domain Name System, BIG-IP Link Controller, BIG-IP Local...

Eclipse ThreadX NetX Duo HTTP server denial of service vulnerability

Talos Vulnerability Report TALOS-2024-2098 Eclipse ThreadX NetX Duo HTTP server denial of service vulnerability April 14, 2025 CVE Number CVE-2025-2260,None SUMMARY A denial of service vulnerability exists in the NetX HTTP server functionality of Eclipse ThreadX NetX Duo git commit 6c8e9d1. A...

📄 RemotePC Remote Code Execution

RemotePC suffers from an unauthenticated remote code execution vulnerability. The release for this on github offers no version information. Exploit Title: RemotePC - Unauthenticated RCE Date: 2025-04-14 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://github.com/akoc95/RemotePC Version: latest...

Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow vulnerability

Talos Vulnerability Report TALOS-2024-2105 Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow vulnerability April 14, 2025 CVE Number None,CVE-2025-2258 SUMMARY An integer underflow vulnerability exists in the HTTP server PUT request functionality of Eclipse ThreadX NetX Du...

CVE-2025-32632

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KaizenCoders Automatic Ban IP automatic-ban-ip allows Reflected XSS.This issue affects Automatic Ban IP: from n/a through = 1.0.7...

CVE-2025-0124

An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include syste...

CVE-2025-0125

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the...