CVE-2025-1048 Sonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability

Sonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2025-1048

CVE-2025-1048 pertains to Sonos Era 300 speakers, where the/libsmb2 Use-After-Free vulnerability allows network-adjacent attackers to execute arbitrary code without authentication. The flaw arises in SMB data processing due to not validating the existence of an object before operations, enabling ...

Malicious code in quaoqpdizoqsqdqsd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f1f9340c89842abcbd40ae92859a72850ca38d95401add0c0bf3591b5ab8e8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

(0Day) eCharge Hardy Barth cPH2 index.php Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of eCharge Hardy Barth cPH2 charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of GET parameters provided to the...

Node.js Test CI Security Incident

Node.js Test CI Security Incident Update 23-April-2025 Node.js Test CI Security Incident – Full Disclosure Summary On March 21, 2025, we received a security report via HackerOne link restricted at time of writing, detailing a successful compromise of several Node.js test CI hosts. According to th...

CVE-2025-29446

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2025-43964

A flaw was found in LibRaw. In affected versions, tag 0x412 processing in phaseonecorrect in decoders/loadmfbacks.cpp does not enforce minimum w0 and w1 values. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

BELL-CVE-2025-39755

Bulletin has no description...

BELL-CVE-2025-39930

Bulletin has no description...

SUSE CVE-2025-22046

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Harden uretprobe syscall trampoline check Jann reported a possible issue when trampolinecheckip returns address near the bottom of the address space that is allowed to call into the syscall if uretprobes are not set...

SUSE CVE-2025-22051

In the Linux kernel, the following vulnerability has been resolved: staging: gpib: Fix Oops after disconnect in agilent usb If the agilent usb dongle is disconnected subsequent calls to the driver cause a NULL dereference Oops as the businterface is set to NULL on disconnect. This problem was...

CVE-2025-40114

In the Linux kernel, the following vulnerability has been resolved: iio: light: Add check for array bounds in veml6075readinttimems The array contains only 5 elements, but the index calculated by veml6075readinttimeindex can range from 0 to 7, which could lead to out-of-bounds access. The check...

BELL-CVE-2025-22099

Bulletin has no description...

BELL-CVE-2025-22120

Bulletin has no description...

SUSE CVE-2025-23136

In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 "platform/x86: int3472: Check for adev == NULL". Add a check for adev not...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the improper verification of SignatureValue within SignerInfo. An attacker can manipulate the integrity of signed data by crafting a malicious signature that bypasses validation...

PT-2025-18267 · NetGear · Netgear Wnr2000V2

Name of the Vulnerable Software and Affected Versions: Netgear JWNR2000v2 version 1.0.0.11 Description: A critical issue has been discovered, affecting the check language file function. The manipulation of the host argument leads to a buffer overflow. This issue can be exploited remotely. The...

CVE-2025-32787

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in DeleteIPv6DefaultRouterInRA called by StorePacket. Before dereferencing, DeleteIPv6DefaultRouterInRA does not account for ParsePacket returning NULL,...

CVE-2025-32787

CVE-2025-32787 affects SoftEtherVPN, specifically versions 5.02.5184–5.02.5187. The vulnerability is a NULL dereference in the function DeleteIPv6DefaultRouterInRA, which is called by StorePacket. The underlying cause is that DeleteIPv6DefaultRouterInRA does not handle NULL results from ParsePack...

DEBIAN-CVE-2025-22052

In the Linux kernel, the following vulnerability has been resolved: staging: gpib: Fix Oops after disconnect in niusb If the usb dongle is disconnected subsequent calls to the driver cause a NULL dereference Oops as the businterface is set to NULL on disconnect. This problem was introduced by...