Astra Linux – Vulnerability in ldns

NLnet Labs’ ldns version 1.2.0, including versions up to and including 1.9.0, when used as a stub resolver over UDP, fails to match the query destination address and port with the response source address and port. Moreover, neither the query ID nor the nature of the query matches that of the...

Astra Linux – Vulnerability in Thunderbird

matrix-js-sdk is a client-server SDK for the Matrix messaging protocol, designed for JavaScript. Version 34.11.0 and earlier of matrix-js-sdk was vulnerable to client-side path traversal attacks through crafted MXC URIs. A malicious room member could trigger clients using matrix-js-sdk to send...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fixed a memory leak in nhcpcpurthoutput within fibchecknhv6gw. The function fibchecknhv6gw assumes that fib6nhinit will clean up everything when it fails. The commit 7dd73168e273 „ipv6: Always allocate pcpu memory in fib6nh...

Astra Linux – Vulnerability in GhostScript

A issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow occurs when parsing the filename format string for the output filename, resulting in path truncation, as well as possible path traversal and code execution...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/rds: There is no shortcut for exiting from RDSCONNERROR. RDS connections have a state called “rdsconnpath::cpstate”. Connections transition between states, and this transition occurs under the condition “rdsconnpathtransition...

Astra Linux – Vulnerability in zsh

In Zsh before version 5.8, attackers who were able to execute commands could regain privileges lost due to the --no-PRIVILEGED option. Zsh failed to overwrite the saved user ID, so the original privileges could be restored by executing MODULEPATH=/dir/with/module zmodload with a module that calls...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: qce – fixed the error path in devmqceregisteralgs. If ops-registeralgs fails, the error path repeatedly calls ops-unregisteralgs, which originates from the failed registration process. Instead, use the loop index to...

Astra Linux – Vulnerability in Golang-Google-GRPC

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have a vulnerability caused by improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path did not start with a leading slash...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: padata: avoided UAF Use-after-Allocation for reorderwork. Although the previous patch can prevent UAFs related to ps and ps for doserial, it cannot prevent potential UAF issues for reorderwork. This issue can occur as follows: c...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Fix idafree call while not allocated In the rprocalloc function, when an error occurs, the putdevice&rproc-dev call is made, leading to the invocation of the rproctyperelease function. An error can occur before...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: espintcp: fixed skb leaks. Several error paths now include a kfreeskb...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfs: fixed a resource leak in xfsallocbuftarg In the error path, fsputdax is called to release the DAX device reference...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fixed a panic that occurred when calling skblinearize. The panic can be reproduced by executing the command: ./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000 A kernel panic was then captured: '''...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.1, a heap out-of-bounds read occurred in the smartcard SetAttrib path when cbAttrLen did not match the actual NDR buffer length. This vulnerability has been fixed in version 3.20.1...

Astra Linux – Vulnerability in curl

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take ‘issuercert’ into account, and it compared the involved paths case insensitively, which could...

cve-2021-41773

Cve-2021-41773-grabber Vulnerabilidad de path traversal y divulgación de archivos en Apache HTTP Server 2.4.49 Este script obtiene servidores vulnerables para cve 2021-41773 desde shodan Cómo usar : usa python 3 instala el módulo shodan: pip install shodan cambia la palabra clave en el script por...

CVE-2026-105286

A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit...

Exploit for Path Traversal in Xorux Lpar2Rrd

CVE-2025-54769 - LPAR2RRD Controlled Whoami PoC Controlled C...

EUVD-2026-92385

A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit...

CVE-2026-105286 Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal

A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit...