About Remote Code Execution – SAP NetWeaver (CVE-2025-31324, CVE-2025-42999) vulnerability

About Remote Code Execution - SAP NetWeaver CVE-2025-31324, CVE-2025-42999 vulnerability. SAP NetWeaver is the core SAP platform for running applications and integrating systems. Vulnerabilities were found in its Visual Composer component - a web tool for business app modeling. A lack of...

USN-7754-2: Linux kernel (FIPS) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network traffic control; CVE-2025-38350, CVE-2025-37752, CVE-2024-57996...

OPENSUSE-SU-2025:15557-1 autogen-5.18.16-8.1 on GA media

These are all security issues fixed in the autogen-5.18.16-8.1 package on the GA media of openSUSE Tumbleweed...

PT-2025-38258

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description Dragonfly, an open source P2P-based file distribution and image acceleration system, disables TLS certificate verification in its HTTP clients. These clients are not configurable, preventing users...

Dragonfly's manager makes requests to external endpoints with disabled TLS authentication

The Manager disables TLS certificate verification in two HTTP clients figures 3.1 and 3.2. The clients are not configurable, so users have no way to re-enable the verification. golang func getAuthTokenctx context.Context, header http.Header string, error skipped client := &http.Client Timeout:...

SUSE CVE-2025-10532

Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3...

CLSA-2025-1758039948 protobuf: Fix of CVE-2022-1941

CVE-2022-1941: fix parsing vulnerability in MessageSet type to prevent out of memory failures and DoS attacks...

CVE-2025-55114

The CVE-2025-55114 entry concerns BMC Control-M/Agent. The root cause is the improper ordering of AUTHORIZED_CTM_IP validation, where the Server IP is validated only after an SSL/TLS handshake, exposing the agent to issues in the SSL/TLS implementation under certain non-default conditions (relate...

Vulnerabilities fixed in Apple macOS

Apple has fixed vulnerabilities in macOS. The vulnerabilities include several issues related to accessing sensitive user data, permissions, and security vulnerabilities that could lead to unauthorized access or bypassing sandbox restrictions. These vulnerabilities could be exploited by malicious...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the execution of the pmruntimesetactive operation within a spinlock, which could lead to scheduling issues...

Oracle Linux 8 : kernel (ELSA-2025-15785)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-15785 advisory. - net/sched: ets: use old 'nbands' while purging unused classes Ivan Vecera RHEL-107541 CVE-2025-38350 - netsched: schets: implement lockless etsdump...

A week in security (September 8 – September 14)

Last week on Malwarebytes Labs: AI browsers or agentic browsers: a look at the future of web surfing From Fitbit to financial despair: How one woman lost her life savings and more to a scammer Meta ignored child sex abuse in VR, say whistleblowers When AI chatbots leak and how it happens Fake...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not properly handling sharedcpumap for different tiers of shared caches, which could lead to out-of-bounds acces...

`daemonize` is Unmaintained

There hasn't been any activity happening for this crate since June 3, 2023. No interactions on pull requests. Issues are disabled for the repo. Oldest PR sitting around without any interaction from the maintainer: knsd/daemonize50 On February 14, 2024, a PR was made to correct some UB. Efforts to...

RUSTSEC-2025-0069 `daemonize` is Unmaintained

There hasn't been any activity happening for this crate since June 3, 2023. No interactions on pull requests. Issues are disabled for the repo. Oldest PR sitting around without any interaction from the maintainer: knsd/daemonize50 On February 14, 2024, a PR was made to correct some UB. Efforts to...

OPENSUSE-SU-2025:15553-1 kernel-devel-6.16.7-1.1 on GA media

These are all security issues fixed in the kernel-devel-6.16.7-1.1 package on the GA media of openSUSE Tumbleweed...

Security update for the Linux Kernel (Live Patch 8 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-1506002338 fixes several issues. The following security issues were fixed: CVE-2025-38087: net/sched: fix use-after-free in tapriodevnotifier bsc1245504. CVE-2025-21999: proc: fix UAF in procgetinode bsc1242579. CVE-2025-38001: netsched: hfsc: Address...

metasploit-framework

This repository is an offensive tool for Metasploit Framework. It is a collection of files and workflows used to build and test the Metasploit Framework, a penetration testing tool. The repository contains various templates for reporting issues, suggesting new features, and submitting pull...

SUSE SLES15 Security Update : kernel (Live Patch 41 for SLE 15 SP4) (SUSE-SU-2025:03182-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03182-1 advisory. This update for the Linux Kernel 5.14.21-15040024167 fixes several issues. The following security issues were fixed: - CVE-2025-38001: netsche...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.25 (SUSE-SU-2025:03200-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03200-1 advisory. Update to go1.25.1, released 2025-09-03 bsc1244485. Security issues fixed: - CVE-2025-47910: net/http:...