CVE-2025-29925

XWiki Platform REST API vulnerability CVE-2025-29925: the /rest/wikis/[wikiName]/pages endpoint could disclose information about protected/private pages to unauthenticated users before fixes. The issue occurs because the endpoint listed pages even when the user had no view rights, notably when th...

CVE-2025-26707

creationtimestamp| type| source ---|---|--- 2025-03-11 07:35:35+00:00| seen| https://t.me/cvedetector/20032 2025-03-11 08:00:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lk3lxtq7qd2l...

GHSA-63CR-XG3F-8JVR Leantime allows Stored Cross-Site Scripting (XSS)

Summary Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Details A Stored Cross-Site Scripting XSS vulnerability was found that could potentially compromise user data and pose a...

CVE-2025-1127

creationtimestamp| type| source ---|---|--- 2025-02-13 18:52:33+00:00| seen| https://infosec.exchange/users/cve/statuses/113998086368947353 2025-02-13 19:16:11+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3li3flzjmfv2a 2025-02-13 20:34:57+00:00| seen|...

CVE-2022-31166

XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Starting in versions 11.3.7, 11.0.3, and 12.0RC1, it is possible to exploit a bug in XWikiRights resolution of groups to obtain privilege escalation. More specifically, editing a right with the object editor...

CVE-2025-23681

creationtimestamp| type| source ---|---|--- 2025-01-22 15:19:59+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgdo5h3jiw2f...

CVE-2024-56604

creationtimestamp| type| source ---|---|--- 2024-12-27 15:18:02+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lecbvshtvv2f 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8 2026-03-19 00:00:00+00:00| seen|...

USN-7159-4: Linux kernel (IoT) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - S390 architecture; - x86 architecture; - Power management core; - GPU...

The vulnerability of the loader for AMD Platform Security Processor processors allows a hacker to execute arbitrary code.

The vulnerability of the loader for AMD Platform Security Processor processors involves incorrect checking of the range in the object header. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2024-55663 XWiki Platform has an SQL injection in getdocuments.vm with sort parameter

XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in getdocument.vm; the ordering of the returned documents is defined from an unsanitized request parameter request.sort and can allow any user to inject HQL. Depending on th...

Linaro Trusted Firmware-M 安全漏洞

Linaro Trusted Firmware-M Tf-M is a reference implementation of the Platform Security Architecture Psa IoT security framework from Linaro, UK. A security vulnerability exists in Linaro Trusted Firmware-M version 2.1.0, which stems from not validating user-supplied pointers to invec and outvec...

CVE-2024-46083

Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting XSS. An authenticated user can craft malicious payloads using the messages feature, which allows the injection of malicious code into any user's account on the platform. It is important to note that regular users can trigger...

RHSA-2022:8850 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (python-ujson) security update

Bulletin has no description...

RHSA-2019:3132 Red Hat Security Advisory: OpenShift Container Platform 4.1.20 openshift security update

Bulletin has no description...

UBUNTU-CVE-2024-45157

An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLSPSAHMACDRBGMDTYPE does not cause the PSA subsystem to use HMACDRBG: it uses HMACDRBG only when MBEDTLSPSACRYPTOEXTERNALRNG and...

Trusted Firmware-M 安全漏洞

Linaro Trusted Firmware-M Tf-M is a reference implementation of the Platform Security Architecture Psa IoT security framework from Linaro, UK. A security vulnerability exists in Trusted Firmware-M version 2.0.0 and prior versions, which stems from a lack of parameter validation in the logging...

PT-2024-6380

Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 2.28.9 Mbed TLS versions 3.x prior to 3.6.1 Description The issue is related to the misuse of a cryptographic algorithm in Mbed TLS, where the user-selected algorithm is not used. Specifically, enabling MBEDTLS PSA...

UBUNTU-CVE-2024-43874

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix null pointer dereference in sevsnpshutdownlocked Fix a null pointer dereference induced by DEBUGTESTDRIVERREMOVE. Return from sevsnpshutdownlocked if the pspdevice or the sevdevice structs are not initialized...

CVE-2021-26344

An out of bounds memory write when processing the AMD PSP1 Configuration Block APCB could allow an attacker with access the ability to modify the BIOS image, and the ability to sign the resulting image, to potentially modify the APCB block resulting in arbitrary code execution...

Leave the World Behind, or don’t

I watched Leave the World Behind on Netflix recently. I was intrigued as the trailers showed an oil tanker crashing on to a beach. It was implied that it had been hacked and someone had taken control of it. Shipping security is something we know quite a bit about, having been asked to hack a larg...