Elspec G5 security vulnerabilities

Elspec G5 is a multifunctional digital fault recorder from Elspec, Israel. A security vulnerability exists in Elspec G5 version 1.2.2.19 and earlier, which originates from a physical visitor being able to reset the administrator password by inserting a USB drive containing a specific string...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990620)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990620 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix hungtask for PADATARESET We found a hungtask bug in testaeadveccfg as...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990387)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990387 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: Fix call trace in setuptxdescriptors After PF reset and ethtool -t there was call trace in...

CVE-2025-59392

The Elspec G5 multifunctional digital fault recorder, specifically versions through 1.2.2.19 , contains a vulnerability that allows an attacker with physical access to reset the Admin password . The root cause is the acceptance of a publicly documented reset string when a USB drive is inserted in...

CVE-2025-59392

On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive containing a publicly documented reset string into a USB port...

CVE-2025-59392

On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive containing a publicly documented reset string into a USB port...

PT-2025-45256

Name of the Vulnerable Software and Affected Versions Elspec G5 versions through 1.2.2.19 Description A person with physical access to the device can reset the Admin password by inserting a USB drive containing a publicly documented reset string into a USB port. Recommendations Versions prior to...

CVE-2025-59392: Authentication Bypass Using an Alternate Path or Channel

On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive containing a publicly documented reset string into a USB port...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990606)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990606 advisory. In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix reset-controller leak on probe errors Make sure to release the lane reset...

CVE-2025-6027

The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators...

CVE-2025-6027 Ace User Management <= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest

The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators...

CVE-2025-6027

The Ace User Management WordPress plugin (versions through 2.0.3 ) is vulnerable to an improperly validated password reset token vulnerability. Because the plugin fails to verify that a reset token is correctly associated with the requesting user, any authenticated user—including those with minim...

CVE-2025-6027 Ace User Management <= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest

The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators...

CVE-2025-12157

The Simple User Capabilities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxnoprivresetcapability' AJAX endpoint in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to reset any...

CVE-2025-55342

Quipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean identification number for all registered users via the Administracion/usuarios/cambiarpasswordolvidovalidar.php txtlogin parameter...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989438)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989438 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/i915/reset: Fix errorstateread ptr + offset use Fix our pointer offset usage in errorstaterea...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989337)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989337 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: Fix call trace in setuptxdescriptors After PF reset and ethtool -t there was call trace in...

PT-2025-45083

Name of the Vulnerable Software and Affected Versions Ace User Management WordPress plugin versions through 2.0.3 Description The Ace User Management WordPress plugin does not properly validate that a password reset token is associated with the requesting user. This allows authenticated users, ev...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990382)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990382 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: megaraidsas: Fix for a potential deadlock This fixes a 'possible circular locking dependen...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990231)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990231 advisory. In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI...