Microsoft Windows NTFS 资源管理错误漏洞

Microsoft Windows NTFS is a file system from Microsoft USA that serves computer files. The file system has error warning, disk self-healing, and logging capabilities. Microsoft Windows NTFS suffers from a resource management error vulnerability that stems from an attacker's ability to elevate...

Rockwell Automation ArmorStart AOP 安全漏洞

Rockwell Automation ArmorStart AOP is a distributed motor controller from Rockwell Automation. The Rockwell Automation ArmorStart AOP suffers from a denial of service vulnerability that originates from entering an invalid value into a COM method, which can be exploited by an attacker to cause a...

Linux Distros Unpatched Vulnerability : CVE-2022-50521

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - platform/x86: mxm-wmi: fix memleak in mxmwmicallmxds|mx The ACPI buffer memory out.pointer returned by wmievaluatemethod is not freed after the call, so it lead...

EulerOS 2.0 SP11 : kernel (EulerOS-SA-2025-2230)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : dochangetype: refuse to operate on unmounted/not ours mountsCVE-2025-38498 HID: core: ensure the allocated report buffer can contain the reserved...

GHSA-R7R6-CC7P-4V5M python-ldap has sanitization bypass in ldap.filter.escape_filter_chars

Summary The sanitization method ldap.filter.escapefilterchars can be tricked to skip escaping of special characters when a crafted list or dict is supplied as the assertionvalue parameter, and the non-default escapemode=1 is configured. Details The method ldap.filter.escapefilterchars supports 3...

CVE-2025-61921

CVE-2025-61921 affects Sinatra up to version 4.1.x (pre-4.2.0), where parsing of If-Match and If-None-Match headers during response construction with etag can consume excessive time, enabling a possible DoS. The issue is tied to the header parsing component and impacts applications using the etag...

EUVD-2025-33767

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response. Carefully crafted...

CVE-2025-61921 Sinatra has ReDoS vulnerability in ETag header value generation

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response. Carefully crafted...

Improper Authorization

org.springframework, spring-core is vulnerable to improper authorization. The vulnerability is due to incorrect annotation resolution on methods within type hierarchies that use unbounded generics, which allows an attacker to bypass security checks when Spring Security’s @EnableMethodSecurity...

[SECURITY] Fedora 41 Update: ibus-bamboo-0.8.4~RC6-2.fc41

A Vietnamese IME for IBus using Bamboo Engine. The open source Vietnamese keyboard supports most common encodings, popular Vietnamese typing methods, smart diacritics, spell checking, shortcuts,...

[SECURITY] Fedora 42 Update: ibus-bamboo-0.8.4~RC6-2.fc42

A Vietnamese IME for IBus using Bamboo Engine. The open source Vietnamese keyboard supports most common encodings, popular Vietnamese typing methods, smart diacritics, spell checking, shortcuts,...

CVE-2025-61921: Inefficient Regular Expression Complexity

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response. Carefully crafted...

CVE-2025-59976

An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file...

CVE-2025-59976 Junos Space: Arbitrary file download vulnerability in web interface

An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file...

PT-2025-41410

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos Space versions prior to 24.1R3 Description A flaw exists in the web interface of Junos Space that could allow a network-based attacker with valid credentials to download arbitrary files from the file system. An attacker...

SUSE CVE-2022-50521

In the Linux kernel, the following vulnerability has been resolved: platform/x86: mxm-wmi: fix memleak in mxmwmicallmxds|mx The ACPI buffer memory out.pointer returned by wmievaluatemethod is not freed after the call, so it leads to memory leak. The method results in ACPI buffer is not used, so...

PT-2025-41260

Name of the Vulnerable Software and Affected Versions vaahcms version 2.3.1 Description A cross-site scripting issue exists in vaahcms version 2.3.1. A remote attacker can potentially execute arbitrary code through the upload method within the storeAvatar function of the UserBase.php file...

CVE-2025-61183: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar method of UserBase.php...

CVE-2025-61183

VaahCMS version 2.3.1 is vulnerable to Stored Cross-Site Scripting (XSS) via the storeAvatar() method in UserBase.php. The root cause is a race condition where files are physically saved to a predictable public path (/storage/media/YYYY/MM/.svg) before content or MIME-type validation occurs. An a...

PT-2025-41597

Name of the Vulnerable Software and Affected Versions Sinatra versions prior to 4.2.0 Description Sinatra, a domain-specific language for creating web applications in Ruby, contains an issue where carefully crafted input can cause excessive processing time during the parsing of If-Match and...