UBUNTU-CVE-2025-68738

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix null pointer deref in mt7996conftx If a link does not have an assigned channel yet, mt7996viflink returns NULL. We still need to store the updated queue settings in that case, and apply them later. Move th...

CVE-2025-68738 wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix null pointer deref in mt7996conftx If a link does not have an assigned channel yet, mt7996viflink returns NULL. We still need to store the updated queue settings in that case, and apply them later. Move th...

CVE-2025-68738

In the Linux kernel, the MT7996 Wi‑Fi driver fix for CVE-2025-68738 resolves a null pointer dereference in mt7996_conf_tx(). If a link has no assigned channel yet, mt7996_vif_link could return NULL while updates to queue settings still needed, so the fix moves the queue parameter storage inside s...

CVE-2023-53997

In the Linux kernel, the following vulnerability has been resolved: thermal: of: fix double-free on unregistration Since commit 3d439b1a2ad3 "thermal/core: Alloc-copy-free the thermal zone parameters structure", thermalzonedeviceregister allocates a copy of the tzp argument and frees it when...

UBUNTU-CVE-2023-54037

In the Linux kernel, the following vulnerability has been resolved: ice: prevent NULL pointer deref during reload Calling ethtool during reload can lead to call trace, because VSI isn't configured for some time, but netdev is alive. To fix it add rtnl lock for VSI deconfig and config. Set...

CVE-2023-54037 ice: prevent NULL pointer deref during reload

In the Linux kernel, the following vulnerability has been resolved: ice: prevent NULL pointer deref during reload Calling ethtool during reload can lead to call trace, because VSI isn't configured for some time, but netdev is alive. To fix it add rtnl lock for VSI deconfig and config. Set...

CVE-2023-54037 ice: prevent NULL pointer deref during reload

In the Linux kernel, the following vulnerability has been resolved: ice: prevent NULL pointer deref during reload Calling ethtool during reload can lead to call trace, because VSI isn't configured for some time, but netdev is alive. To fix it add rtnl lock for VSI deconfig and config. Set...

CVE-2023-53997

CVE-2023-53997 relates to the Linux kernel thermal subsystem. The issue arose from the sequence in which tzp (thermal zone parameters) is allocated and freed during registration and unregistration. After the patch introduced by commit 3d439b1a2ad3 (thermal/core: Alloc-copy-free the thermal zone p...

CVE-2023-53997 thermal: of: fix double-free on unregistration

In the Linux kernel, the following vulnerability has been resolved: thermal: of: fix double-free on unregistration Since commit 3d439b1a2ad3 "thermal/core: Alloc-copy-free the thermal zone parameters structure", thermalzonedeviceregister allocates a copy of the tzp argument and frees it when...

Improper Access Control

@strapi/core is vulnerable to improper access control. The vulnerability is due to improper sanitization of query parameters in the document service lookup operator, which allows an attacker to craft malicious queries to access private fields such as admin passwords and reset tokens...

PT-2025-53330

Name of the Vulnerable Software and Affected Versions Legrand BTicino Driver Manager F454 version 1.0.51 Description The software contains web vulnerabilities that permit attackers to carry out administrative tasks without sufficient request validation. An attacker can leverage cross-site request...

PT-2025-53337

Name of the Vulnerable Software and Affected Versions Teradek VidiU Pro version 3.0.3 Description The software contains a server-side request forgery issue in the management interface. Attackers can manipulate GET parameters url and xml url to bypass firewalls, perform network enumeration, and...

PT-2025-52954

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to thermal zone unregistration, potentially leading to a double-free condition. This issue arises from a copy of the thermal zone parameters...

PT-2025-53004

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the mt76 and mt7996 components. Specifically, a null pointer dereference can occur in the mt7996 conf tx function when a link does not have an...

CVE-2023-53975

Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks...

CVE-2021-47716

Orangescrum 1.8.0 contains multiple cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through various input parameters. Attackers can exploit parameters like 'projid', 'CSmessage', and 'name' to execute arbitrary JavaScript code in victim's browse...

CVE-2021-47716

Orangescrum 1.8.0 is affected by multiple cross-site scripting (XSS) vulnerabilities exposed via authenticated endpoints. The issue arises from insufficient validation of inputs such as projid, CS_message, and name, allowing an attacker to inject arbitrary JavaScript into victims’ browsers by sub...

CVE-2021-47716 Orangescrum 1.8.0 Cross-Site Scripting via Authenticated Endpoints

Orangescrum 1.8.0 contains multiple cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through various input parameters. Attackers can exploit parameters like 'projid', 'CSmessage', and 'name' to execute arbitrary JavaScript code in victim's browse...

CVE-2021-47720

Orangescrum 1.8.0 is affected by an authenticated SQL injection via multiple parameters (old_project_id, project_id, uuid, uniqid). The root cause is insufficient validation of input parameters, allowing attackers with authorization to manipulate database queries and potentially extract or modify...

CVE-2021-47720 Orangescrum 1.8.0 Authenticated SQL Injection via Multiple Parameters

Orangescrum 1.8.0 contains an authenticated SQL injection vulnerability that allows authorized users to manipulate database queries through multiple vulnerable parameters. Attackers can inject malicious SQL code into parameters like oldprojectid, projectid, uuid, and uniqid to potentially extract...