944 matches found
PT-2025-08: Deserialization of untrusted data in TCPDF
This library has a class containing a POP Property Oriented Programming chain. When deserializing this class with certain values ββof some fields, an attacker can delete an arbitrary file from the system. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 20.04.2025...
CVE-2025-23131
In the Linux kernel, the following vulnerability has been resolved: dlm: prevent NPD when writing a positive value to eventdone douevent returns the value written to eventdone. In case it is a positive value, newlockspace would undo all the work, and lockspace would not be set. dlmnewlockspace,...
CVE-2025-23131
In the Linux kernel, the following vulnerability has been resolved: dlm: prevent NPD when writing a positive value to eventdone douevent returns the value written to eventdone. In case it is a positive value, newlockspace would undo all the work, and lockspace would not be set. dlmnewlockspace,...
AZL-62788 CVE-2025-23131 affecting package kernel for versions less than 6.6.144.1-1
In the Linux kernel, the following vulnerability has been resolved: dlm: prevent NPD when writing a positive value to eventdone douevent returns the value written to eventdone. In case it is a positive value, newlockspace would undo all the work, and lockspace would not be set. dlmnewlockspace,...
AZL-69653 CVE-2025-23131 affecting package kernel 5.15.200.1-1
In the Linux kernel, the following vulnerability has been resolved: dlm: prevent NPD when writing a positive value to eventdone douevent returns the value written to eventdone. In case it is a positive value, newlockspace would undo all the work, and lockspace would not be set. dlmnewlockspace,...
CVE-2025-23131
CVE-2025-23131 affects the Linux kernel in the DLM subsystem. The issue occurs when do_uevent returns a positive value written to event_done; this value previously caused new_lockspace to consider it a success, leaving lockspace uninitialized and leading to a NULL pointer dereference in dlm_find_...
CVE-2025-23131
In the Linux kernel, the following vulnerability has been resolved: dlm: prevent NPD when writing a positive value to eventdone douevent returns the value written to eventdone. In case it is a positive value, newlockspace would undo all the work, and lockspace would not be set. dlmnewlockspace,...
Fedora 40 : php-tcpdf (2025-b5809de628)
The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-b5809de628 advisory. Version 6.9.1 2025-04-03 - Fixed Path Traversal security vulnerability reported by Positive Technologies. ---- Version 6.9.0 2025-03-30 - Added PHP 8.4...
PT-2025-17: Unrestricted memory access to internal memory of networking adapter in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family
The vulnerability was identified in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family, versions 231.1.162.1 package version, 1.10.3 hwrm spec. The discovered vulnerability is related to improper access control to the network adapter memory read/writ...
CVE-2021-47640
In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Fix early region not updated correctly The shadow's page table is not updated when PTERPNSHIFT is 24 and PAGESHIFT is 12. It not only causes false positives but also false negative as shown the following text. Fix ...
CVE-2021-47640 powerpc/kasan: Fix early region not updated correctly
In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Fix early region not updated correctly The shadow's page table is not updated when PTERPNSHIFT is 24 and PAGESHIFT is 12. It not only causes false positives but also false negative as shown the following text. Fix ...
CVE-2021-47640
In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Fix early region not updated correctly The shadow's page table is not updated when PTERPNSHIFT is 24 and PAGESHIFT is 12. It not only causes false positives but also false negative as shown the following text. Fix ...
PT-2025-70: Heap-based buffer overflow during HTTP-header parsing in LCD KVM over IP switch CL5708IM
The vulnerability was identified in LCD KVM over IP switch CL5708IM firmware version v2.2.215. The discovered vulnerability allows an attacker to cause a denialβofβservice attack. A heapβbased buffer overflow occurs during HTTPβheader parsing, enabling unauthenticated remote attacker to corrupt...
CVE-2020-15131
In SLP Validate npm package slp-validate before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any ...
PT-2025-02: Access to files or directories to external paties in TCPDF
The vulnerability was identified in TCPDF, version 6.8.0. The discovered vulnerability allows an attacker to transmit a specially created HTML file containing an image in Base64 format. Using the specified payload, the attacker can access an arbitrary image outside of the directory. Vulnerability...
SUSE CVE-2025-21656
In the Linux kernel, the following vulnerability has been resolved: hwmon: drivetemp Fix driver producing garbage data when SCSI errors occur scsiexecutecmd function can return both negative linux codes and positive scsicmnd result field error codes. Currently the driver just passes error codes o...
I have finalized the list of trending vulnerabilities for 2024 according to Positive Technologies
I have finalized the list of trending vulnerabilities for 2024 according to Positive Technologies. Last year, 74 vulnerabilities were classified as trending to compare the scale, just over 40,000 were added to NVD in 2024. All trending vulnerabilities are found in Western commercial products and...
DEBIAN-CVE-2024-57888
In the Linux kernel, the following vulnerability has been resolved: workqueue: Do not warn when cancelling WQMEMRECLAIM work from !WQMEMRECLAIM worker After commit 746ae46c1113 "drm/sched: Mark scheduler work queues with WQMEMRECLAIM" amdgpu started seeing the following warning: workqueue:...
PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file
Unauthorized Reflected XSS in the Accounting.php file Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 8.2 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N CVSS vector v.4.0: 8.3...
CVE-2024-53212
In the Linux kernel, the following vulnerability has been resolved: netlink: fix false positive warning in extack during dumps Commit under fixes extended extack reporting to dumps. It works under normal conditions, because extack errors are usually reported during -start or the first -dump, it's...