CVE-2025-14708 Shiguangwu sgwbox N3 WIREDCFGGET http_eshell_server buffer overflow

A weakness has been identified in Shiguangwu sgwbox N3 2.0.25. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/httpeshellserver of the component WIREDCFGGET Interface. Executing manipulation of the argument params can lead to buffer overflow. The attack may be...

SGWBox N3 安全漏洞

SGWBox N3 is a network storage device from China's Pickup Dock SGWBox. A security vulnerability exists in SGWBox N3 version 2.0.25, which stems from incorrect manipulation of the parameter params in the file /usr/sbin/httpeshellserver, which could result in a buffer overflow...

SGWBox N3 命令注入漏洞

SGWBox N3 is a network storage device from China's Pickup Dock SGWBox. A command injection vulnerability exists in SGWBox N3 version 2.0.25, which stems from incorrect manipulation of the parameter params in the file /usr/sbin/httpeshellserver, which could lead to command injection...

SGWBox N3 命令注入漏洞

SGWBox N3 is a network storage device from China's Pickup Dock SGWBox. A command injection vulnerability exists in SGWBox N3 version 2.0.25, which stems from incorrect manipulation of the parameter params in the file /usr/sbin/httpeshellserver, which could lead to command injection...

CVE-2025-48618

In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48618

In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-53745

CVE-2023-53745 affects the Linux kernel: a memory-leak in the vector_config path where uml_parse_vector_ifspec returning NULL requires freeing allocated params via kfree to prevent leak. The connected documents consistently describe the same fix in Linux kernel code paths (vector_config) and refe...

AZL-71404 CVE-2025-40264 affecting package kernel for versions less than 6.6.119.3-1

In the Linux kernel, the following vulnerability has been resolved: be2net: pass wrbparams in case of OS2BMC beinsertvlaninpkt is called with the wrbparams argument being NULL at besendpkttobmc call site. This may lead to dereferencing a NULL pointer when processing a workaround for specific...

ASB-A-404254549

In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

An unsafe default behavior in Rack::QueryParser allows bypass of the paramslimit parameter count restriction when query string parameters are delimited by semicolons ; rather than ampersands &. The parser counts only & when enforcing the limit, while still splitting on both & and ;. As a result, ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989859)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989859 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy field-spanning write warning in mwifiexconfigscan Replace one-element...

CVE-2025-62419

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vulnerability exists in the DB2 and MongoDB data source configuration handlers. In the DB2 data source handler, when the extraParams field is empty, the HOSTNAME, PORT, and DATABASE...

Unity Linux 20.1070e Security Update: bluez (UTSA-2025-680605)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-680605 advisory. BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate paramslen. Tenable has...

EUVD-2023-12353

Malicious code in bioql PyPI...

EUVD-2025-26059

Malicious code in bioql PyPI...

EUVD-2022-50089

Malicious code in bioql PyPI...

EUVD-2023-36014

Malicious code in bioql PyPI...

SUSE CVE-2023-53507

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister devlink params in case interface is down Currently, in case an interface is down, mlx5 driver doesn't unregister its devlink params, which leads to this WARN1. Fix it by unregistering devlink params in that...

CVE-2023-53507 net/mlx5: Unregister devlink params in case interface is down

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister devlink params in case interface is down Currently, in case an interface is down, mlx5 driver doesn't unregister its devlink params, which leads to this WARN1. Fix it by unregistering devlink params in that...

Ubuntu 24.04 LTS / 25.04 : Rack vulnerability (USN-7784-1)

The remote Ubuntu 24.04 LTS / 25.04 host has a package installed that is affected by a vulnerability as referenced in the USN-7784-1 advisory. It was discovered that Rack incorrectly handled limiting the amount of parameters. An attacker could possibly use this issue to bypass the paramslimit...