AIX is vulnerable to a denial of service (CVE-2025-26466) and a machine-in-the-middle attack (CVE-2025-26465) due to OpenSSH

IBM SECURITY ADVISORY First Issued: Mon Mar 17 15:30:45 CDT 2025 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/opensshadvisory18.asc Security Bulletin: AIX is vulnerable to a denial of service CVE-2025-26466 and a machine-in-the-middl...

Malicious code in datamations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d84ce38228e36b03c093e2ea202e25365aba0af056a385ef287d0df4af03f109 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in contaxy-webapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e369d55f0561aa0c1af981aea283045a266800715c8ecfdcd178cece2cc853b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 42 Update: vyper-0.4.1-1.fc42

Pythonic Smart Contract Language for the EVM...

Announcing the winners of the Adaptive Prompt Injection Challenge (LLMail-Inject)

We are excited to announce the winners of LLMail-Inject, our first Adaptive Prompt Injection Challenge! The challenge ran from December 2024 until February 2025 and was featured as one of the four official competitions of the 3rd IEEE Conference on Secure and Trustworthy Machine Learning IEEE...

scsi: storvsc: Ratelimit warning logs to prevent VM denial of service

...

Iced training platform Code Execution

The vulnerability of the Iced training platform for machine learning H2O is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2025-25774

An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may cause an exception in the AMF's internal state machine, leading to an AMF crash and resulting in a Denial of Service DoS...

Exploit for OS Command Injection in Magnussolution Magnusbilling

Magnus Billing System v7 Exploit This Python script automates...

CVE-2025-25774: Insufficient Control Flow Management

An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may cause an exception in the AMF's internal state machine, leading to an AMF crash and resulting in a Denial of Service DoS...

PT-2025-11111 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS version 2.7.2 Description: An issue in Open5GS can cause an exception in the AMF's internal state machine when a UE switches between two gNBs and sends a handover request at a specific time. This can lead to an AMF crash, resulting in...

SUSE-SU-2025:0833-2 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2022-49080: mm/mempolicy: fix mpolnew leak in sharedpolicyreplace bsc1238033. - CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization guest/host mode behind...

kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Keep xfdstate in sync with MSRIA32XFD The Linux kernel CVE team has assigned CVE-2024-35801 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051738-CVE-2024-35801-8038@gregkh/T...

PT-2025-33024

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Cortex XDR® Broker VM affected versions not specified Description: A credential management flaw exists in Palo Alto Networks Cortex XDR® Broker VM where different Broker VM images share identical default credentials for...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-56780)

"The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-56780 advisory. - In the Linux kernel, the following vulnerability has been resolved: quota: flush quotareleasework upon quot...

Amazon Linux 2 : openssh (ALAS-2025-2769)

The version of openssh installed on the remote host is prior to 7.4p1-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2769 advisory. A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed ...

CVE-2025-22226

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process...

The Combined Cipher Machine

Interesting article--with photos!--of the US/UK "Combined Cipher Machine" from WWII...

Medium: openssh

Issue Overview: A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying...

Medium: openssh

Issue Overview: A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying...