Helicalinsight SQL injection vulnerability

Helicalinsight versions 7.0.0 and earlier have a SQL injection vulnerability. This vulnerability arises from report parameter values sent to /executeDatasource that are not properly escaped. Attackers can use custom Numeric or String placeholder values to bypass the ineffective SqlDetect...

Kitae Park Mang Board Cross-site Scripting Vulnerability

Kitae Park’s Mang Board 2.4.4 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the content parameters. It is possible to bypass the cleaning by omitting the datatype parameter in the modify request,...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL versions prior to 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20, and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, ther...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: rtw88: Fixed an array overflow in rtwgettxpowerparams When using the kernel with the Undefined Behaviour Sanity Checker UBSAN enabled, the following array overflow was logged:...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/amd/display: Skip Recompute DSC Params if no Stream on Link Why A NULL pointer dereference occurred during MST and DSC setup. BUG: NULL pointer dereference in the kernel, address: 0000000000000008 PGD 0 P4D 0 Oops: 0000 1...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: cx23885: Add the missing unmap in sndcx23885hwparams In the error path, add cx23885alsadmaunmap to release the resource acquired by cx23885alsadmamap...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: be2net: Pass the wrbparams parameter in case of OS2BMC. The function beinsertvlaninpkt is called with the wrbparams argument being NULL at the besendpkttobmc call site. This may lead to dereferencing a NULL pointer during the...

Astra Linux – vulnerability in ruby-rack

Rack is a modular Ruby web server interface. In versions prior to 2.2.14, 3.0.16, and 3.1.14, Rack::QueryParser parses query strings and application/x-www-form-urlencoded bodies into Ruby data structures without imposing any limit on the number of parameters. This allows attackers to send request...

Astra Linux – Vulnerability in python-bottle

Packages from versions 0 and before 0.12.19 are vulnerable to Web Cache Poisoning, due to a mechanism called “parameter cloaking”. When attackers can separate query parameters using a semicolon ;, they can create a discrepancy in the interpretation of requests between the proxy running with defau...

Astra Linux – vulnerability in mbedtls

An issue was found in Mbed TLS prior to version 2.25.0 as well as prior to version 2.16.9 LTS and version 2.7.18 LTS. In this context, a NULL algorithm parameter entry appears identical to an array containing REAL values with size zero; consequently, the certificate is deemed valid. However, if...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmsmac – added a gain range check to wlcPhyiqcalgainparamsnphy. In wlcPhyiqcalgainparamsnphy, add a gain range check to WARN, instead of potentially unsafe access to the tbliqcalgainparamsnphy array. This fix has been...

Astra Linux – vulnerability in bluez

BlueZ versions prior to 5.59 allow physically proximate attackers to obtain sensitive information, as profiles/audio/avrcp.c fails to validate paramslen...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: xfrm: add NULL check in xfrmupdateaeparams Normally, x-replayesn and x-preplayesn should be allocated at xfrmallocreplaystateesn... in xfrmstateconstruct..., hence xfrmupdateaeparams... is okay to update them. However, the curren...

Astra Linux – vulnerability in Firefox and Thunderbird

When viewing directory listings for chrome:// URLs as source text, certain parameters were reflected. This vulnerability affects Firefox ESR 102.1, Firefox ESR 91.12, Firefox 103, Thunderbird 102.1, and Thunderbird 91.12...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Added error handling to pairdevice. The hciconnparamsadd function never checks for a NULL value, which could lead to a NULL pointer dereferencing and resulting in a crash. This issue has been fixed by adding erro...

Astra Linux – Vulnerability in Golang-1.23

ReverseProxy can forward queries containing parameters that are not visible to the Rewrite function. When used with a Rewrite function, or a Director function that parses query parameters, ReverseProxy sanitizes the forwarded request by removing parameters that are not parsed by url.ParseQuery...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch only validates the fixed part of the LE Set CIG Parameters response. After that part is extracted from the skb, the hcicclesetcigparams...

Astra Linux – vulnerability in Zabbix

The Zabbix Agent 2 item key smart.disk.get fails to sanitize its parameters before passing them to a shell command, potentially leading to a remote code execution vulnerability...

CVE-2026-47168

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the TryPathsHandler or TryFilesFilter process. An attacker can manipulate query parameters by crafting a request path containing reserve...