TencentOS Server 4: microcode_ctl (TSSA-2024:0485)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0485 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CLSA-2025-1749821936 openssh: Fix of CVE-2025-32728

CVE-2025-32728: fix logic error in DisableForwarding option...

Logic Flaw Vulnerability in Apartment Management System of Lianyi Technology Co.

Upper TechSoft is committed to creating an integrated environment of digital teaching, research, management and life for Chinese universities and colleges, and ultimately realizing a comprehensive service-oriented smart campus with informatization of education, scientific decision-making and...

macOS 13.x < 13.7.4 (122902)

The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.7.4. It is, therefore, affected by a vulnerability: - A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been...

catdoc zero-day, NVIDIA, High-Logic FontCreator and Parallel vulnerabilities

Cisco Talos' Vulnerability Discovery & Research team recently disclosed three zero-day vulnerabilities in catdoc, as well as vulnerabilities in Parallel, NVIDIA and High-Logic FontCreator 15. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adheren...

CLSA-2025-1749552061 openssh: Fix of CVE-2025-32728

CVE-2025-32728: fix logic error in DisableForwarding option...

CLSA-2025-1749482356 openssh: Fix of CVE-2025-32728

CVE-2025-32728: fix logic error in DisableForwarding option...

GHSA-XQXC-X6P3-W683 Deno run with --allow-read and --deny-read flags results in allowed

Summary deno run --allow-read --deny-read main.ts results in allowed, even though 'deny' should be stronger. Same with all global unary permissions given as --allow- --deny-. Details Caused by the fast exit logic in 22894. PoC Run the above command expecting no permissions to be passed. Impact Th...

Deno run with --allow-read and --deny-read flags results in allowed

Summary deno run --allow-read --deny-read main.ts results in allowed, even though 'deny' should be stronger. Same with all global unary permissions given as --allow- --deny-. Details Caused by the fast exit logic in 22894. PoC Run the above command expecting no permissions to be passed. Impact Th...

CVE-2025-20001

An out-of-bounds read vulnerability exists in High-Logic FontCreator 15.0.0.3015. A specially crafted font file can trigger this vulnerability which can lead to disclosure of sensitive information. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability...

CVE-2025-20001

An out-of-bounds read vulnerability exists in High-Logic FontCreator 15.0.0.3015. A specially crafted font file can trigger this vulnerability which can lead to disclosure of sensitive information. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability...

CVE-2025-20001

An out-of-bounds read vulnerability exists in High-Logic FontCreator 15.0.0.3015. A specially crafted font file can trigger this vulnerability which can lead to disclosure of sensitive information. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability...

CVE-2025-20001

An out-of-bounds read vulnerability exists in High-Logic FontCreator 15.0.0.3015. A specially crafted font file can trigger this vulnerability which can lead to disclosure of sensitive information. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability...

CVE-2025-20001

High-Logic FontCreator 15.0.0.3015 is affected by CVE-2025-20001 (TALOS-2025-2157): an out-of-bounds read in the GSUB subtable processing of OpenType fonts, leading to potential disclosure of sensitive information when a user opens a specially crafted font file. Exploitation requires user interac...

CVE-2025-29785

quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to trigger a nil-pointer dereference by a malicious QUIC client. In order to do so, the attacker first sends valid QUIC packets from different...

quic-go 安全漏洞

quic-go is an implementation of the QUIC protocol, RFC 9000 protocol, in Go by the individual developer Lucas Clemente. A security vulnerability exists in versions of quic-go prior to v0.50.1, which stems from a path-probing packet loss recovery logic issue that could lead to null pointer...

High-Logic FontCreator GSUB subtable Out-Of-Bounds Read Vulnerability

Talos Vulnerability Report TALOS-2025-2157 High-Logic FontCreator GSUB subtable Out-Of-Bounds Read Vulnerability June 2, 2025 CVE Number CVE-2025-20001 SUMMARY An out-of-bounds read vulnerability exists in High-Logic FontCreator 15.0.0.3015. A specially crafted font file can trigger this...

PT-2025-23529 · High Logic · Fontcreator

Name of the Vulnerable Software and Affected Versions: High-Logic FontCreator version 15.0.0.3015 Description: An out-of-bounds read issue exists, allowing disclosure of sensitive information. This can be triggered by a specially crafted font file, requiring an attacker to trick a user into openi...

High-Logic FontCreator 缓冲区错误漏洞

High-Logic FontCreator is a font editor from High-Logic. A security vulnerability exists in High-Logic FontCreator version 15.0.0.3015, which originates from an out-of-bounds read when processing specially crafted font files...

CVE-2024-7096

A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: SOAP admin services are accessible to the attacker. The...