CVE-2025-1371

GNU elfutils 0.192 is affected via readelf.c in the eu-read handle_dynamic_symtab code path, where a null pointer dereference can occur with local attack access. The vulnerability is described as exploitable locally, and public exploits/ PoCs have been disclosed. A patch is available (commit/tag ...

CVE-2025-1365 GNU elfutils eu-readelf readelf.c process_symtab buffer overflow

A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function processsymtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The explo...

CVE-2025-1352

A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function libdwthreadtail in the library libdwalloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. Th...

Microsoft Excel 2016 Multiple Vulnerabilities (KB5002687)

This host is missing an important security update according to Microsoft KB5002687 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Distribution's token authentication allows to inject an untrusted signing key in a JWT

Impact Systems running registry version 3.0.0-beta.1 with token authentication enabled. Patches Update to at least v3.0.0-rc.3 Workarounds There is no way to work around this issue without patching if your system requires token authentication. References The issue lies in how the JWK verification...

CVE-2025-24976

Distribution is a toolkit to pack, ship, store, and deliver container content. Systems running registry versions 3.0.0-beta.1 through 3.0.0-rc.2 with token authentication enabled may be vulnerable to an issue in which token authentication allows an attacker to inject an untrusted signing key in a...

CVE-2025-24976 Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT

Distribution is a toolkit to pack, ship, store, and deliver container content. Systems running registry versions 3.0.0-beta.1 through 3.0.0-rc.2 with token authentication enabled may be vulnerable to an issue in which token authentication allows an attacker to inject an untrusted signing key in a...

CVE-2024-54015

CVE-2024-54015 affects Siemens SIPROTEC 5 devices (multiple CP300/CP150 variants) with SNMP GET handling. The root cause is improper validation of SNMP GET requests, allowing an unauthenticated remote attacker to retrieve sensitive information via SNMPv2 GET using default credentials. Publicly st...

AZL-56655 CVE-2025-1176 affecting package binutils for versions less than 2.37-13

A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function bfdelfgcmarkrsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather...

AZL-56579 CVE-2025-1176 affecting package binutils for versions less than 2.41-4

A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function bfdelfgcmarkrsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather...

DEBIAN-CVE-2025-1152

A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The...

UBUNTU-CVE-2025-1150

A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfdmalloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an attack is rather high...

PT-2025-6076 · Unknown · Cool-Admin-Java

Name of the Vulnerable Software and Affected Versions: cool-admin-java version v1.0 Description: A stored cross-site scripting XSS vulnerability in the Parameter List module of cool-admin-java allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the...

Azure Linux 3.0 Security Update: kernel (CVE-2024-42102)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42102 advisory. - In the Linux kernel, the following vulnerability has been resolved: Revert mm/writeback: fix possible...

PT-2025-6077

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.43 Description A memory leak issue has been found in the xstrdup function of the ld component. This issue can be exploited remotely, but the complexity of an attack is rather high, and the exploitability is difficult. Th...

Photon OS 4.0: Linux PHSA-2025-4.0-0742

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0742. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Azure Linux 3.0 Security Update: emacs (CVE-2024-30203)

The version of emacs installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-30203 advisory. - In Emacs before 29.3, Gnus treats inline MIME contents as trusted. CVE-2024-30203 Note that Nessus has not...

CVE-2022-35936

Ethermint is an Ethereum library. In Ethermint running versions before v0.17.2, the contract selfdestruct invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the DeleteAccountfunction, all contracts that used the identical bytecod...

CVE-2024-43367

Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assumption made when handling ECMAScript's AsyncGenerator operations can cause an uncaught exception on certain scripts. Boa's implementation of AsyncGenerator...

CVE-2024-45051

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed versio...