Packet Storm New Exploits for March, 2025

This archive contains all of the 223 exploits added to Packet Storm in March, 2025...

Arbitrary File Read Vulnerability in NCC Data Source Configuration Center of New Way Technology Co.

Xindao Technology Co., Ltd. is a company primarily engaged in the software and information technology service industry. An arbitrary file read vulnerability exists in the NCC Data Source Configuration Center of New Way Technology Co. Ltd. that can be exploited by attackers to obtain sensitive...

Ubuntu 24.10 : MariaDB vulnerability (USN-7376-1)

The remote Ubuntu 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7376-1 advisory. A security issue was discovered in MariaDB and this update includes a new upstream MariaDB version to fix the issue. In addition to security fixes, the updated packag...

OpenAI Bug Bounty Program Increases Top Reward to $100,000

OpenAI Bug Bounty program boosts max reward to $100,000, expanding scope and offering new incentives to enhance AI security and reliability...

USN-7376-1 mariadb vulnerability

A security issue was discovered in MariaDB and this update includes a new upstream MariaDB version to fix the issue. In addition to security fixes, the updated packages contain bug and regression fixes, new features, and possibly incompatible changes...

Medium: libxslt

Issue Overview: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information. CVE-2023-40403...

SUSE CVE-2025-2724

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The code maintainer explains that "the only way to get an object of type GsfMSOleSortingKey is via gsfmsolesortingkeyne...

OpenSlides 安全漏洞

OpenSlides is a free, web-based presentation and assembly system from OpenSlides Open Source. It is used to manage and project agendas, motions and elections for assemblies. A security vulnerability exists in versions of OpenSlides prior to 4.2.5 that stems from not properly filtering HTML elemen...

The vulnerability of the `ntfs_get_block_vbo()` function in the `fs/ntfs3/inode.c` module of the Linux operating system allows a hacker to induce a service failure.

The vulnerability of the ntfsgetblockvbo function in the fs/ntfs3/inode.c module of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the `nvkm_client_new()` function in the `drivers/gpu/drm/nouveau/nvkm/core/client.c` file of the Nouveau driver module allows a hacker to cause a service failure. This vulnerability relates to the Direct Rendering Infrastructure (DRI) support in NVIDIA’s Linux kernel-based graphics drivers.

The vulnerability of the nvkmclientnew function in the drivers/gpu/drm/nouveau/nvkm/core/client.c file of the Nouveau driver, a driver for supporting Direct Rendering Infrastructure DRI in NVIDIA graphics cards and Linux operating systems, is related to improper resource locking. Exploiting this...

CVE-2025-29923

creationtimestamp| type| source ---|---|--- 2025-03-20 18:20:44+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8247 2025-03-20 21:04:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lktlxbicuc2m 2025-03-20 21:35:07+00:00| seen|...

CVE-2025-1474

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user accou...

GHSA-GFP2-6QHM-7X43 The WikiManager REST API allows any user to create wikis

Impact Any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager...

DLA-4085-1 tzdata - new timezone database

Bulletin has no description...

Moderate: Red Hat Security Advisory: ACS 4.7 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes RHACS. The updated image includes new features and security and bug fixes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base...

Malicious code in new-nav-docusaurus-2-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 056a07097ce29a75544b9e104af6e236c35ff7aeac79d48c35c1a208a779f41e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2391 Malicious code in new-nav-docusaurus-2-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 056a07097ce29a75544b9e104af6e236c35ff7aeac79d48c35c1a208a779f41e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the NTFS file system of the Windows operating system, which allows a perpetrator to disclose protected information

The vulnerability of the NTFS file system in Windows operating systems is related to the disclosure of password values in the log files. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by these files...

PT-2025-10716 · Libzvbi +5 · Libzvbi +5

Name of the Vulnerable Software and Affected Versions: libzvbi versions 0.2.43 and earlier Description: A critical issue has been found that affects the vbi search new function in the src/search.c file. The manipulation of the pat len argument leads to an integer overflow. This issue can be...

Siemens SCALANCE LPE9403 操作系统命令注入漏洞

Siemens SCALANCE LPE9403 is a local processing engine for industrial field data processing from Siemens. It is used to capture, collect and pre-process industrial field data. The Siemens SCALANCE LPE9403 6GK5998-3GS00-2AC2 suffers from an operating system command injection vulnerability that...