10292 matches found
CVE-2025-22207
Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of comscheduler...
UBUNTU-CVE-2025-21703
In the Linux kernel, the following vulnerability has been resolved: netem: Update sch-q.qlen before qdisctreereducebacklog qdisctreereducebacklog notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of the child qdisc before calling it. Otherwise it wou...
Joomla! 安全漏洞
Joomla! is a free, open source content management system from Joomla! open source. A security vulnerability exists in Joomla! versions 4.0.0 through 4.4.10 and 5.1.0 through 5.2.3, which stems from an improperly constructed ORDER clause and can lead to SQL injection attacks...
The Official DOGE Website Launch Was a Security Mess
Plus: Researchers find RedNote lacks basic security measures, surveillance ramps up around the US-Mexico border, and the UK ordering Apple to create an encryption backdoor comes under fire...
UBUNTU-CVE-2024-31144
For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.htmlobject-model-overview Xapi contains functionality to backup and restore metadata about Virtual Machines and Storage Repositories SRs. The metadata itself is stored in a Virtual Disk Image VDI inside ...
CVE-2024-13692
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.4.5 via several functions due to missing validation on a user...
CVE-2024-13641
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This makes it possible for...
SUSE CVE-2024-6284
In https://github.com/google/nftables IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intended might block or not block the desired addresses. This issue affects: https://pkg.go.dev/github.com/google/[email protected] The bug was fixe...
CVE-2024-13692
The CVE-2024-13692 entry for Return Refund and Exchange For WooCommerce (woo-refund-and-exchange-lite) is confirmed as a real vulnerability. It is an Insecure Direct Object Reference (IDOR) in all versions up to 4.4.5 caused by missing validation on a user-controlled key. This flaw allows unauthe...
CVE-2025-25067
creationtimestamp| type| source ---|---|--- 2025-02-13 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-16 2025-02-13 21:40:52+00:00| seen| https://infosec.exchange/users/cve/statuses/113998748157088863 2025-02-13 22:16:10+00:00| seen|...
PT-2025-16667
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition in the Linux kernel's streamzap driver can cause a general protection fault due to a NULL pointer dereference of the dev-raw pointer. This occurs because rc unregister...
DEBIAN-CVE-2025-21695
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-uart-backlight: fix serdev race The delluartblserdevprobe function calls devmserdevdeviceopen before setting the client ops via serdevdevicesetclientops. This ordering can trigger a NULL pointer dereference in...
CVE-2025-21695 platform/x86: dell-uart-backlight: fix serdev race
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-uart-backlight: fix serdev race The delluartblserdevprobe function calls devmserdevdeviceopen before setting the client ops via serdevdevicesetclientops. This ordering can trigger a NULL pointer dereference in...
WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation vulnerability
Missing Authorization to Unauthenticated Post Order Manipulation vulnerability discovered by incognito in WordPress Plugin The Ultimate WordPress Toolkit – WP Extended versions = 3.0.13...
Apple ordered to grant access to users’ encrypted data
Last week, an article in the Washington Post revealed the UK had secretly ordered Apple to provide blanket access to protected cloud backups around the world. Since then, privacy focused groups have uttered their objections. The UK government has demanded to be able to access encrypted data store...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: netfilter: iptables: Fixed null-ptr-deref in iptablenattableinit. We received a report that iptables-restore sometimes triggered null-ptr-deref at boot time. 0 The problem is that iptablenattableinit is exposed to user space befo...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: drm/msm/a6xx: Avoid a nullptr dereference when the speedbin setting fails Calling a6xxdestroy before adrenogpuinit leads to a null pointer dereference on msmgpucleanup: platformsetdrvdatagpu-pdev, NULL; This occurs because...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: iouring: A potential deadlock has been fixed in ioregisteriowqmaxworkers. The ioregisteriowqmaxworkers function calls ioputsqdata, which acquires the sqd-lock without releasing the uringlock. Similar to the commit 009ad9f0c6ee...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: mm: Avoid leaving partial pfn mappings in error cases. As Jann points out, PFN mappings are special. Unlike normal memory mappings, there is no lifetime information associated with the mapping—it’s simply a raw mapping of PFNs,...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-cmdq: Move devmmboxcontrollerregister after devmpmruntimeenable. When mtk-cmdq unbind itself, a WARNON message with the condition pmruntimegetsync 0 is generated. According to the call trace below: cmdqmboxshutdown...