CVE-2025-64530 @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields...

OWASP Top 10 Business Logic Abuse: What You Need to Know

Over the past few years, API security has gone from a relatively niche concern to a headline issue. A slew of high-profile breaches and compliance mandates like PCI DSS 4.0 have woken security teams up to the reality that APIs are the front door to their data, infrastructure, and revenue streams...

Apollo Federation 安全漏洞

Apollo Federation is an architecture for the Apollo community to declaratively combine APIs into a unified graph. A security vulnerability exists in Apollo Federation versions prior to 2.9.5, prior to 2.10.4, prior to 2.11.5, and prior to 2.12.1, which stems from a flaw in the combination logic...

Siemens SIMATIC S7-1500 Out-of-bounds Read (CVE-2019-20367)

nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table strtab. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

UBUNTU-CVE-2025-40199

In the Linux kernel, the following vulnerability has been resolved: pagepool: Fix PPMAGICMASK to avoid crashing on some 32-bit arches Helge reported that the introduction of PPMAGICMASK let to crashes on boot on his 32-bit parisc machine. The cause of this is the mask is set too wide, so the...

CVE-2025-40206 netfilter: nft_objref: validate objref and objrefmap expressions

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftobjref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit at 000000008bda5b8c...

CVE-2025-40169 bpf: Reject negative offsets for ALU ops

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative offsets for ALU ops When verifying BPF programs, the checkaluop function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check...

CVE-2025-40169

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative offsets for ALU ops When verifying BPF programs, the checkaluop function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check...

CVE-2025-40155

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: debugfs: Fix legacy mode page table dump logic In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault,...

CVE-2025-64687

In JetBrains YouTrack before 2025.3.104432 improper access control allowed modify MCP tool logic...

CVE-2025-63296

KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: during startup /usr/sbin/anykaservice.sh scans mounted TF/SD cards and, if /mnt/update.nor.sh is present, copies it to /tmp/net.sh and executes it as root...

MAL-2025-82920 Malicious code in ade-mie93-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40720e81dac657f08b4f9e36f8f35360ac72485d85fceeac57764f7b131929ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in logical_jaguar_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aed6de2c5c7409e6c42d0846dd0407a59b12e136de6ab2f5005a714e395935b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-44050

In JetBrains YouTrack before 2025.3.104432 improper access control allowed modify MCP tool logic...

CVE-2025-64687

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it was fixed before public disclosure and did not affect any released versions...

CVE-2025-64687

...

CVE-2025-64687

Summary : JetBrains YouTrack prior to version 2025.3.104432 is affected by an improper access control issue that can allow modification of MCP tool logic. This vulnerability is described across multiple sources (Red Hat, ENISA EUVD, CIRCL/CVE sightings, CNNVD, and others) and specifically impacts...

编号撤回

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in versions prior to JetBrains YouTrack 2025.3.104432, which...

PT-2025-46156

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2025.3.104432 Description Improper access control in JetBrains YouTrack allowed modification of MCP tool logic. Recommendations Update to version 2025.3.104432 or later...

CVE-2025-36185

IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows includes Db2 Connect Server could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic...