Buffer overflow in sponge queue functions

Impact The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more. Patches Yes, see commit fdc6fef0...

PT-2025-40196

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contained memory leaks related to socket sk and zero-copy sk buffs skbs when using TX timestamping. The issue was identified through syzkaller reports, which demonstrate...

PT-2025-38349

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak was identified in the DRM/amdgpu module during the amdgpu ring fini function. The fences associated with the mes queue were not being freed, leading to a memory leak...

PT-2025-40718

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.0-rc5lblk+ 5 Description The Linux kernel contained a flaw in the null block null blk driver related to the handling of queue mode settings through configfs. Specifically, the code did not adequately validate...

PT-2025-40226

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's v4l2-mem2mem subsystem related to insufficient locking protection of the num rdy parameter. This can lead to data races when accessing this parameter...

CVE-2022-47522

The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept possibly cleartext target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point such as authentication...

PT-2025-49478

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the media subsystem, specifically within the MediaTek vcodec decoder queue setup function. A user-supplied variable, nplanes, obtained through a syste...

CVE-2022-47522: Authentication Bypass by Spoofing

The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept possibly cleartext target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point such as authentication...

CVE-2023-27643

An issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button in Queue and Select Folders button in Library...

WP SMTP Mailing Queue < 2.0.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Navigate to "Settings SMTP Mailing Queue Tools"...

WP SMTP Mailing Queue < 2.0.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Navigate to "Settings SMTP Mailing Queue...

HPESBNW04465 rev.3 - HPE Aruba Bypassing Wi-Fi Encryption by Manipulating Transmit Queues, Multiple Vulnerabilities

Potential Security Impact: Remote: Denial of Service DoS, Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba Virtual and Hardware-based Mobility Conductors - see vulnerability summary for details Affected Products ArubaOS Wi-Fi Controllers and Campus/...

WordPress SMTP Mailing Queue Plugin <= 1.4.7 is vulnerable to Cross Site Scripting (XSS)

Software SMTP Mailing Queue Type Plugin Vulnerable versions = 1.4.7 Fixed in 2.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 28dbb3603702 Credits WordFence Required privilege...

Wi-Fi Packet Buffering Weak Encryption Man-in-the-Middle

The vulnerability of the mechanism for scheduling buffer allocations for Wi-Fi packet buffering technology is related to the use of weak encryption. Exploiting this vulnerability could allow a remote attacker to carry out a “man-in-the-middle” attack...

PT-2025-54065

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.2.8-1.el7.centos.x86 64 1 Description The Linux kernel’s net failover component contains an issue where the transmission queue txq size can exceed the expected limit. Specifically, the failover txq is initializ...

PT-2025-40232

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.16.0-rc3-syzkaller Description The Linux kernel contains a flaw within the RDMA/cma subsystem. Specifically, the issue relates to allowing only UD qp type to join multicast, and setting qkey to default if it's...

CVE-2023-25680

IBM Robotic Process Automation 21.0.1 through 21.0.5 is vulnerable to insufficiently protecting credentials. Queue Provider credentials are not obfuscated while editing queue provider details. IBM X-Force ID: 247032...

CVE-2023-25680

IBM Robotic Process Automation 21.0.1 through 21.0.5 is vulnerable to insufficiently protecting credentials. Queue Provider credentials are not obfuscated while editing queue provider details. IBM X-Force ID: 247032...

Code injection

IBM Robotic Process Automation 21.0.1 through 21.0.5 is vulnerable to insufficiently protecting credentials. Queue Provider credentials are not obfuscated while editing queue provider details. IBM X-Force ID: 247032...

CVE-2023-25680 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.1 through 21.0.5 is vulnerable to insufficiently protecting credentials. Queue Provider credentials are not obfuscated while editing queue provider details. IBM X-Force ID: 247032...