Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fixed an array overflow issue in stsetup. The array size is now adjusted to match the parameter size, rather than using a fixed value...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: do not use socpcmret on the .prepare callback. The commit 1f5664351410 states, “ASoC: lower the log severity when no backend DAIs are enabled for …”. This commit ignores the -EINVAL error message when using soc PCM...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmsmac – added a gain range check to wlcPhyiqcalgainparamsnphy. In wlcPhyiqcalgainparamsnphy, add a gain range check to WARN, instead of potentially unsafe access to the tbliqcalgainparamsnphy array. This fix has been...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fixed the null check for pipectx-planestate in resourcebuildscalingparams A null pointer dereference issue could occur when pipectx-planestate is null. The fix adds a check to ensure that ‘pipectx-planestate’ is...

PHPGurukul Rail Pass Management System 代码注入漏洞

Rail Pass Management System is a rail pass management system. The Rail Pass Management System suffers from a cross-site scripting vulnerability that occurs due to unfiltered pagedes parameters of an unknown function in the /admin/aboutus.php file. The vulnerability can be exploited by an attacker...

TencentOS Server 3: weldr-client (TSSA-2023:0092)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0092 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Liferay Portal和Liferay DXP 资源管理错误漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

CVE-2025-45987

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the dns1 and dns2 parameters in the bsSetDNSInfo...

CVE-2025-49188

The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering...

XWiki allows remote code execution through default value of wiki macro wiki-type parameters

Impact Any user with edit right on a page could be the user's profile can execute code Groovy, Python, Velocity with programming right by defining a wiki macro. This allows full access to the whole XWiki installation and thus impacts its confidentiality, integrity and availability. The main probl...

GHSA-9875-CW22-F7CX XWiki allows remote code execution through default value of wiki macro wiki-type parameters

Impact Any user with edit right on a page could be the user's profile can execute code Groovy, Python, Velocity with programming right by defining a wiki macro. This allows full access to the whole XWiki installation and thus impacts its confidentiality, integrity and availability. The main probl...

CVE-2025-49582

XWiki platform is affected by a remote code execution risk due to incomplete required-right analyzers for dangerous macros. The issue allows a page to include Groovy or Python macros hidden by a user with lower privileges, which could be executed when another user with higher rights edits the pag...

CVE-2025-49582 XWiki's required right warnings for macros are incomplete

XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are...

CVE-2025-49581 XWiki allows remote code execution through default value of wiki macro wiki-type parameters

XWiki is a generic wiki platform. Any user with edit right on a page could be the user's profile can execute code Groovy, Python, Velocity with programming right by defining a wiki macro. This allows full access to the whole XWiki installation. The main problem is that if a wiki macro parameter...

CVE-2025-45987

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the dns1 and dns2 parameters in the bsSetDNSInfo...

LB-LINK多款产品 安全漏洞

LB-LINK BL-X26 and others are products of China Bilink LB-LINK.LB-LINK BL-X26 is a wireless router.LB-LINK BL-LTE300 is a wireless router.LB-LINK BL-AC2100 is a wireless Wi-Fi 6 router. A security vulnerability exists in several LB-LINK products, which stems from a command injection in the dns1 a...

The vulnerability of the tool for viewing content parameters on a software platform based on Git, which is used for collaborative code development on GitLab. This vulnerability stems from the lack of protective measures for website structures, allowing attackers to carry out XSS attacks.

The vulnerability of the tool for viewing content parameters on the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to carry out XSS...

Oracle Linux 8 : perl-FCGI:0.78 (ELSA-2025-8696)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-8696 advisory. - Fix CVE-2025-40907 integer overflow when parsing FastCGI parameters perl-FCGI - Fix CVE-2025-40907 integer overflow when parsing FastCGI parameters perl-FCGI ...

CVE-2025-45987

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the dns1 and dns2 parameters in the bsSetDNSInfo...

CVE-2025-45987

This CVE affects Blink router models: BL-WR9000 (v2.4.9), BL-AC2100 AZ3 (v1.0.4), BL-X10 AC8 (v1.0.5), BL-LTE300 (v1.2.3), BL-F1200 AT1 (v1.0.0), BL-X26 AC8 (v1.2.8), BLAC450M AE4 (v4.0.0), and BL-X26 DA3 (v1.2.7). The issue is multiple command injection in the bs_SetDNSInfo function via dns1 and...