CVE-2025-0451

Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Medium...

Fedora 41 : chromium (2025-2525ddc3f2)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2525ddc3f2 advisory. Updated to 132.0.6834.159 Medium CVE-2025-0762: Use after free in DevTools Tenable has extracted the preceding description block directly from the...

Quorum onQ OS 6.0.0.5.2064 Cross Site Scripting

Quorum onQ OS version 6.0.0.5.2064 suffers from a cross site scripting vulnerability. + Credits: Shahnawaz Shaikh, Security Researcher at Cybergate Defense LLC + twitter.com/striv3r Vendor https://quorum.com/about/ Product Quorum onQ OS - 6.0.0.5.2064 Vulnerability Type Reflected Cross Site...

CVE-2025-0762

Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2025-0762

CVE-2025-0762 concerns Google Chrome/Chromium DevTools: a use-after-free in DevTools for builds prior to 132.0.6834.159, enabling potential heap corruption from a crafted Chrome Extension. Affected component is Chrome/Chromium DevTools; the underlying cause is a use-after-free defect (exact inter...

Advisory ROSA-SA-2025-2662

software: openssh 9.5 OS: ROSA-CHROME packageevrstring: openssh-9.5 CVE-ID: CVE-2023-51385 BDU-ID: 2023-08955 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the SSH protocol implementation of the OpenSSH cryptographic security tool is related to the introduction or modification of an argument...

Advisory ROSA-SA-2025-2649

software: jasper 2.0.32 WASP: ROSA-CHROME packageevrstring: jasper-2.0.32 CVE-ID: CVE-2023-51257 BDU-ID: 2024-00902 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the jasimagedecode function of the JasPer library set's JPC encoder is related to an operation exceeding buffer boundaries in memory...

Advisory ROSA-SA-2025-2635

software: ncurses 6.2 WASP: ROSA-CHROME packageevrstring: ncurses-6.2 CVE-ID: CVE-2023-29491 BDU-ID: 2023-05772 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the ncurses terminal I/O control library is related to the ability to write beyond buffer boundaries in memory. Exploitation of the...

Advisory ROSA-SA-2025-2576

software: xwayland 23.2.7 WASP: ROSA-CHROME packageevrstring: xwayland-23.2.7-1 CVE-ID: CVE-2024-9632 BDU-ID: 2024-09084 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the XkbSetCompatMap function of the X Window System X.Org Server implementation is related to a buffer overflow in dynamic memor...

Advisory ROSA-SA-2025-2570

software: php 7.4.33 WASP: ROSA-CHROME packageevrstring: php-7.4.33-11 CVE-ID: CVE-2022-4900 BDU-ID: 2023-02666 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the phpcliserverstartupworkers sapi/cli/phpcliserver.c function of the PHP programming language interpreter is related to an operation...

SpagoBI 3.5.1 Cross Site Request Forgery Vulnerability

CVE-2024-54792 Severity : Medium 6.1 CVSS score : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Summary : Engineering Ingegneria Informatica SpagoBI version 3.5.1 is affected by CSRF in the admin panel that manages user grants. Poc The add/edit/delete user panel, accessible by the admin user, do n...

SpagoBI 3.5.1 Cross Site Scripting Vulnerability

CVE-2024-54795 Severity : Medium 5.4 CVSS score : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Summary : Engineering Ingegneria Informatica SpagoBI version 3.5.1 is affected by multiple stored XSS inside of the worksheet designer page. Poc Steps to Reproduce : 1. While editing a document insertin...

SpagoBI 3.5.1 Cross Site Scripting

SpagoBI versions 3.5.1 and below suffer from persistent cross site scripting vulnerabilities. CVE-2024-54795 Severity : Medium 5.4 CVSS score : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Summary : Engineering Ingegneria Informatica SpagoBI version 3.5.1 is affected by multiple stored XSS inside...

Tuesday, January 21, 2025 Security Releases

Tuesday, January 21, 2025 Security Releases Security releases available Updates are now available for the 23.x, 22.x, 20.x, 18.x Node.js release lines for the following issues. This security release includes the following dependency updates to address public vulnerabilities: undici v7.2.3, v6.21....

BIT-PYTHON-MIN-2024-6232 Regular-expression DoS when parsing TarFile headers

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives...

CVE-2025-0439

Race in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0441

Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information from the system via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0441

Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information from the system via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0440

Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0443

Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...