vulkan-loader:instance_enumerate_fuzzer: Heap-buffer-overflow in get_override_layer_override_paths

Project: https://github.com/khronosgroup/Vulkan-Loader.git Detailed Report: https://oss-fuzz.com/testcase?key=6740380288876544 Project: vulkan-loader Fuzzing Engine: afl Fuzz Target: instanceenumeratefuzzer Job Type: aflasanvulkan-loader Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1...

Apache Subversion: mod_dav_svn denial-of-service via control characters in paths

...

SUSE SLES15 / openSUSE 15 Security Update : rubygem-rack (SUSE-SU-2025:0874-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0874-1 advisory. - CVE-2025-25184: Fixed escape sequence injection vulnerability in rack leading to possible log injection bsc1237141 -...

Security update for subversion

This update for subversion fixes the following issues: CVE-2024-46901: Fixed moddavsvn denial-of-service via control characters in paths bsc1234317 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively...

TikTok: Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers).

A stored cross-site scripting vulnerability was discovered in TikTok's contact form backend. Malicious code submitted through the form executed when administrators viewed the submission, exposing sensitive internal data such as cookies, API keys, internal paths, emails, and phone numbers...

PAN-OS File Path Deletion

The vulnerability of the PAN-OS operating system is related to incorrect external management of file names or file paths. Exploiting this vulnerability allows a malicious actor to delete arbitrary files under the user “nobody”...

SUSE CVE-2025-27610

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, Rack::Static can serve files under the specified root: even if urls: are provided, which may expose other files under the specified root: unexpectedly. The vulnerability occurs becaus...

CVE-2024-51320

Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /servlet/gsdmfsavehtmltmp, /servlet/gsdmbtlkopenfile components...

CVE-2025-27398

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly neutralize special characters when interpreting user controlled log paths. This could allow an authenticated highly-privileged remote attacker to execute a limited set of...

CVE-2025-27397

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly limit user controlled paths to which logs are written and from where they are read. This could allow an authenticated highly-privileged remote attacker to read and write...

CVE-2025-27398

CVE-2025-27398 affects Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) prior to version 4.0. The issue is an OS command injection where user-controlled log paths are not properly neutralized, enabling an authenticated, highly-privileged attacker to run a limited set of binaries already present on t...

CVE-2025-27397

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly limit user controlled paths to which logs are written and from where they are read. This could allow an authenticated highly-privileged remote attacker to read and write...

CVE-2025-27397

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly limit user controlled paths to which logs are written and from where they are read. This could allow an authenticated highly-privileged remote attacker to read and write...

CVE-2025-27397

Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) is affected by CVE-2025-27397. All versions below V4.0 fail to properly restrict user-controlled log paths, enabling an authenticated, highly-privileged attacker to read and write arbitrary files if the path ends with 'log'. Connected sources confirm ...

CVE-2025-27398: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly neutralize special characters when interpreting user controlled log paths. This could allow an authenticated highly-privileged remote attacker to execute a limited set of...

Siemens SCALANCE LPE9403: Operating System Command Injection Vulnerability

Siemens SCALANCE LPE9403 is a native processing engine for industrial field data processing from Siemens, Germany. It is used to capture, collect and pre-process industrial field data. Siemens SCALANCE LPE9403 6GK5998-3GS00-2AC2 V4.0 and prior versions suffer from an operating system command...

PT-2025-10743

Name of the Vulnerable Software and Affected Versions SCALANCE LPE9403 versions prior to V4.0 Description A vulnerability has been identified where affected devices do not properly neutralize special characters when interpreting user-controlled log paths. This could allow an authenticated...

PT-2025-10642

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.13 Rack versions prior to 3.0.14 Rack versions prior to 3.1.12 Description The issue arises from the Rack::Static component not properly sanitizing user-supplied paths before serving files, allowing encoded path...

Virtual environment (venv) activation scripts don't quote paths

...

CVE-2025-21841

CVE-2025-21841 : Linux kernel vulnerability in cpufreq/amd-pstate where amd_pstate_update_limits() takes a cpufreq_policy reference but fails to decrement the refcount on an exit path. This can lead to a use-after-free or resource mismanagement depending on refcount handling. The issue is resolve...