CVE-2025-57156

NULL pointer dereference in the dacpreplyplayqueueeditclear function in src/httpddacp.c in owntone-server through commit 6d604a1 newer commit after version 28.12 allows remote attackers to cause a Denial of Service crash...

CVE-2025-57155

Summary: CVE-2025-57155 affects owntone-server due to a NULL pointer dereference in the daap_reply_groups function (src/httpd_daap.c) triggered by a commit 5e6f19a, after version 28.2. This flaw allows remote attackers to cause a Denial of Service. What’s affected: owntone-server builds prior to ...

PT-2026-3653

Name of the Vulnerable Software and Affected Versions owntone-server versions prior to the commit after version 28.2 Description A flaw exists in owntone-server due to a NULL pointer dereference within the daap reply groups function, located in src/httpd daap.c. This issue, present through commit...

CVE-2025-57155

NULL pointer dereference in the daapreplygroups function in src/httpddaap.c in owntone-server through commit 5e6f19a newer commit after version 28.2 allows remote attackers to cause a Denial of Service...

CVE-2025-63648

CVE-2025-63648 concerns a NULL pointer dereference in the function dacp_reply_playqueueedit_move (src/httpd_dacp.c) in owntone-server, triggered by a crafted DACP request. The issue is tied to commit b7e385f and has been reported across multiple sources (SUSE, Red Hat, NVD, OSV, CVE lists). Docum...

CVE-2025-57155

NULL pointer dereference in the daapreplygroups function in src/httpddaap.c in owntone-server through commit 5e6f19a newer commit after version 28.2 allows remote attackers to cause a Denial of Service...

CVE-2025-57156

Summary (CVE-2025-57156) : A NULL pointer dereference in the owntone-server component, specifically in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c, can be triggered by a remote attacker through commits up to 6d604a1 (post-version 28.12). This vulnerability allows remote Denial...

CVE-2025-57155

NULL pointer dereference in the daapreplygroups function in src/httpddaap.c in owntone-server through commit 5e6f19a newer commit after version 28.2 allows remote attackers to cause a Denial of Service...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001201)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001201 advisory. The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service system crash via a long RPC...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000701)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000701 advisory. net/ceph/authnone.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service NULL pointer dereference and system crash or possibly have...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003085)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003085 advisory. An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aacsendrawsrb...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001787)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001787 advisory. The nfs4getacluncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002145)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002145 advisory. The nfs4getacluncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003316)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003316 advisory. An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aacsendrawsrb...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001213)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001213 advisory. An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aacsendrawsrb...

CVE-2025-40978

Stored Cross-Site Scripting XSS vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request to ‘/ticket/x/conversion’, using the ‘replydescription’ parameter...

CVE-2025-40978

WorkDo eCommerceGo SaaS is affected by a Stored Cross-Site Scripting (XSS) vulnerability. The issue stems from insufficient validation of user input delivered via a POST to /ticket/x/conversion using the reply_description parameter, enabling stored XSS. The Red Hat/CIRCL/CNNVD entries corroborate...

CVE-2025-40978 Multiple vulnerabilities in WorkDo products

Stored Cross-Site Scripting XSS vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request to ‘/ticket/x/conversion’, using the ‘replydescription’ parameter...

CVE-2025-40975

CVE-2025-40975 describes a stored Cross-Site Scripting (XSS) vulnerability in WorkDo’s HRMGo. The issue arises from insufficient validation of user input in the description parameter of a POST to /hrmgo/ticket/changereply, allowing injected scripts to be stored. Root cause: lack of proper input v...

WorkDo HRM SaaS HR and Payroll Tool 跨站脚本漏洞

WorkDo HRM SaaS HR and Payroll Tool is a human resource management software from WorkDo, Inc. WorkDo HRM SaaS HR and Payroll Tool suffers from a cross-site scripting vulnerability that stems from insufficient validation of user input for the replydescription parameter when sending a POST request ...