Intel QAT 缓冲区错误漏洞

Intel QAT Windows software refers to the collection of Intel® Data Protection and Compression Acceleration Technology software components that provide support for the Windows operating system. An out-of-bounds write vulnerability exists in Intel QAT Windows software that originates from an...

PT-2025-46292

Name of the Vulnerable Software and Affected Versions WP-Iconics plugin for WordPress versions prior to 0.0.5 Description The WP-Iconics plugin for WordPress is susceptible to Stored Cross-Site Scripting through multiple parameters of the wp iconics shortcode. Insufficient input sanitization and...

PT-2025-46357

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 145 Firefox ESR versions prior to 140.5 Description A same-origin policy bypass exists within the DOM Notifications component. This allows for potential unauthorized access or manipulation of data due to insufficient...

SAP CommonCryptoLib 缓冲区错误漏洞

SAP CommonCryptoLib is a cryptographic library from SAP, a German company. A buffer error vulnerability exists in SAP CommonCryptoLib that originates from a failure to perform the necessary boundary checks when parsing specially crafted ASN.1 data in the network during pre-authentication, which...

Intel® Thread Director Visualizer Software Advisory

Summary: A potential security vulnerability for some Intel® Thread Director Visualizer software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-31940 Description: Incorrect default permissions...

CVE-2025-11578

A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker...

CVE-2025-11892

An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege escalation and unauthorized workflow triggers. Successful exploitation requires an attacker to have...

CVE-2025-11578

A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker...

CVE-2025-11578 Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation

A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker...

CVE-2025-11578 Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation

A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker...

CVE-2025-11578

CVE-2025-11578 is a privilege-escalation vulnerability in GitHub Enterprise Server. An authenticated Enterprise admin could abuse a symlink escape in pre-receive hook environments to replace system binaries during hook cleanup and inject their SSH key into root’s authorized_keys, enabling root SS...

CVE-2025-64508

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" highly compressed brotli streams, such as many zeros can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the...

CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1...

CVE-2025-64508 Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" highly compressed brotli streams, such as many zeros can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the...

CVE-2025-64484 OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashe...

CVE-2025-64484 OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashe...

EUVD-2025-50806

Dell PowerScale OneFS, versions prior to 9.10.1.3 and versions 9.11.0.0 through 9.12.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2025-62780

CVE-2025-62780 is a stored XSS in changedetection.io’s Watch update API present in versions prior to 0.50.34. Exploitation involves injecting an unsafe URL as a Watch (either when creating a new watch or updating an existing one); when a user previews, the injected JavaScript payload can execute....

CVE-2025-48055

The CVE-2025-48055 entry concerns Combodo iTop, a web-based IT service management tool. Concrete details across connected sources show a stored XSS vulnerability in the user portal’s browse brick, affecting versions prior to 3.2.2. The root cause is improper handling/display of content in the bro...

CVE-2025-47286

Combodo iTop is affected by CVE-2025-47286 in versions prior to 2.7.13 and 3.2.2, where an administrator can execute server code by editing the iTop configuration. Versions 2.7.13 and 3.2.2 introduce checks/escaping of the config parameter before command execution. Affected component: iTop config...