Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from imc-pmu's incorrect use of a mutex lock in the IRQ disable zone...

GHSA-56P6-QW3C-FQ2G Suspended Directus user can continue to use session token to access API

Summary Since the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to access the API despite their status. Details There is a check missing in verifySessionJWT to verify that a user is actually still active and allowed to...

CVE-2025-2562

Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without generating a corresponding log event, via the use of the autotyping functionality. This issue affects Remote Desktop Manager versions from...

CVE-2025-2528

CVE-2025-2528 in Devolutions Remote Desktop Manager for Windows is due to improper authorization in the application password policy, allowing an authenticated user to use a configuration not mandated by admins. Affected versions span 2024.3.29 and earlier, and 2025.1.24–2025.1.25. Remediation is ...

CVE-2025-30163

CVE-2025-30163 affects Cilium’s node-based network policies: policies using fromNodes/toNodes may incorrectly permit traffic to/from non-node endpoints sharing the same labels. Affected versions are Cilium v1.16.0–v1.16.7 and v1.17.0–v1.17.1; the issue is fixed in v1.16.8 and v1.17.2. Root cause:...

The vulnerabilities of the functions adp5589_keypad_add() and adp5589_probe() in the ADP5589 driver (drivers/input/keyboard/adp5589-keys.c) in the Linux kernel allow a hacker to induce a service failure.

The vulnerability of the adp5589keypadadd and adp5589probe functions in the ADP5589 driver drivers/input/keyboard/adp5589-keys.c in the Linux kernel is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a system failure...

CVE-2024-8765

In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly identifies certain endpoints as public if the path contains '/auth/' anywhere within it. This allows unauthenticated attackers to access sensitive endpoints by including '/auth/' in the pat...

GHSA-837Q-JHWX-CMPV Parse Server has an OAuth login vulnerability

Impact The 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication providers to be used across multiple Parse Server apps. For example, if a user signed up using the same authentication provider in two unrelated Parse Server apps, th...

Parse Server has an OAuth login vulnerability

Impact The 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication providers to be used across multiple Parse Server apps. For example, if a user signed up using the same authentication provider in two unrelated Parse Server apps, th...

CVE-2025-30168 Parse Server has an OAuth login vulnerability

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication providers to be used across multiple Parse...

The vulnerability of the function ieee80211_start_tx_ba_session() in the kernel module net/mac80211/agg-tx.c of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the function ieee80211starttxbasession in the net/mac80211/agg-tx.c module of the Linux kernel is related to the passing of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

Vulnerability of the function dcn30_apply_idle_power_optimizations() in the drivers/gpu/drm/amd/display/dc/dcn30/dcn30HWSeq.c module of the Linux operating system, which allows a hacker to trigger a service failure

The vulnerability of the dcn30applyidlepoweroptimizations function in the drivers/gpu/drm/amd/display/dc/dcn30/dcn30HWSeq.c module of the Linux operating system is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

GHSA-FJCF-3J3R-78RP LiteLLM Has an Improper Authorization Vulnerability

An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internaluserviewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the applicatio...

CVE-2024-12777

The CVE-2024-12777 entry describes a Denial of Service in aimhubio/aim 3.25.0 caused by misuse of the sshfs-client. The tracking server is single-threaded and can become unresponsive when asked to connect to an unresponsive socket via sshfs. The root cause is the lack of an additional timeout in ...

CVE-2024-8053 Improper Authentication in open-webui/open-webui

In version v0.3.10 of open-webui/open-webui, the api/v1/utils/pdf endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading...

CVE-2024-8053

Open WebUI vulnerability CVE-2024-8053 affects open-webui/open-webui v0.3.10 where the api/v1/utils/pdf endpoint lacks authentication, allowing unauthenticated access to the PDF generation service. Exploitation can involve sending a POST with an excessively large payload, potentially exhausting s...

CVE-2024-8765

CVE-2024-8765 affects lunary-ai/lunary (git afc5df4). The privilege check logic erroneously marks endpoints as public if the path contains "/auth/" anywhere, allowing unauthenticated attackers to access sensitive endpoints and potentially obtain/modify data or leverage resources across organizati...

Code-Projects Real Estate Property Management System 安全漏洞

Code-Projects Real Estate Property Management System is an open source real estate property management system from Code-Projects. A security vulnerability exists in Code-Projects Real Estate Property Management System version 1.0, which stems from an incorrect operation of the parameters...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere due to the improper validation of target registry domains during the token exchange process. An attacker can extract and misuse authentication tokens by directin...

CVE-2024-12604 Improper Authentication in Tapandsign Technologies Tap and Sign App

Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Technologies Tap&Sign App allows Password Recovery Exploitation, Functionality Misuse. This issue affects Tap&Sign App: before V.1.025...