Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a lack of bounds checking for persistent handle contexts...

CVE-2025-0676

This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input validation to inject and execute systems commands. Successful exploitation could result in privilege escalation, allowing the attacker to...

BIT-DOLIBARR-2022-4093 SQL Injection in dolibarr/dolibarr

SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In...

Malicious code in jcl-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5db8fba1d3af4871fe70fb88d7eef37a6740477ddfe683e8258afa4345d7055 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Important: Red Hat Security Advisory: RHODF-4.14-RHEL-9 security update

Updated images are now available for RHODF-4.14-RHEL-9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

tcpdump 操作系统命令注入漏洞

tcpdump is a set of sniffing tools from Tcpdump team running under command line. The tool is mainly used for packet analysis and network traffic capture, among others. A security vulnerability exists in tcpdump, which stems from command injection and could lead to elevation of privilege and...

TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-027

This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker needs...

Important: Red Hat Security Advisory: RHODF-4.16-RHEL-9 security update

Updated images are now available for RHODF-4.16-RHEL-9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

Malicious code in ilovingcats (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bbf798857d246d05c268c052e1b394b82f9a62af9af62ff888c2ff03bb2d4f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2023-52976

In the Linux kernel, the following vulnerability has been resolved: efi: fix potential NULL deref in efimemreservepersistent When iterating on a linked list, a result of memremap is dereferenced without checking it for NULL. This patch adds a check that falls back on allocating a new page in case...

Zero-Day Alert: Google Releases Chrome Patch for Exploit Used in Russian Espionage Attacks

Google has released out-of-band fixes to address a high-severity security flaw in its Chrome browser for Windows that has been exploited in the wild as part of attacks targeting organizations in Russia. The vulnerability, tracked as CVE-2025-2783 , has been described as a case of "incorrect handl...

Important: Red Hat Security Advisory: VolSync 0.12.1 security fixes and enhancements for RHEL 9

VolSync v0.12 general availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Malicious code in gaimes-fun (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa65f4433275ee9c01057f21b5c3be7d3f23b729e2525a56cbaf26e3d564838f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-9103 Persistent XSS in blocked messages

Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security Blocked Messages module allows Stored XSS. This issue affects Email Security through 8.5.5...

CVE-2024-9103 Persistent XSS in blocked messages

Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security Blocked Messages module allows Stored XSS. This issue affects Email Security through 8.5.5...

UAT-5918 Targets Taiwan's Critical Infrastructure Using Web Shells and Open-Source Tools

Threat hunters have uncovered a new threat actor named UAT-5918 that has been attacking critical infrastructure entities in Taiwan since at least 2023. "UAT-5918, a threat actor believed to be motivated by establishing long-term access for information theft, uses a combination of web shells and...

CVE-2025-29923 go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there...

UAT-5918 targets critical infrastructure entities in Taiwan

By Jung soo An, Asheer Malhotra, Brandon White, and Vitor Ventura. Cisco Talos discovered a malicious campaign we track under the UAT-5918 umbrella that has been active since at least 2023. UAT-5918, a threat actor believed to be motivated by establishing long-term access for information theft,...

Malicious code in sign-tx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70ec991a7e81c79ff114b0d5a7a8aa54a20e59af45f834b775ad4814c1e718c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in near-lake-raw-printer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e593a192910f4a7cb2542c2fb2974be98c92be795c5ab639f2d5b31f6e88e0fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...