CVE-2022-50356 net: sched: sfb: fix null pointer access issue when sfb_init() fails

In the Linux kernel, the following vulnerability has been resolved: net: sched: sfb: fix null pointer access issue when sfbinit fails When the default qdisc is sfb, if the qdisc of devqueue fails to be inited during mqprioinit, sfbreset is invoked to clear resources. In this case, the q-qdisc is...

CVE-2022-50356

CVE-2022-50356 affects the Linux kernel’s net: sched: sfb path. When the default qdisc is sfb and dev_queue initialization fails during mqprio_init(), the code calls sfb_reset() to free resources, but the qdisc pointer (q->qdisc) may be NULL, leading to a general protection fault (null pointer...

CVE-2022-50356 net: sched: sfb: fix null pointer access issue when sfb_init() fails

In the Linux kernel, the following vulnerability has been resolved: net: sched: sfb: fix null pointer access issue when sfbinit fails When the default qdisc is sfb, if the qdisc of devqueue fails to be inited during mqprioinit, sfbreset is invoked to clear resources. In this case, the q-qdisc is...

CVE-2022-50354

CVE-2022-50354 pertains to the Linux kernel component drm/amdkfd, where the fix for kfd_process_device_init_vm error handling was applied. The affected code path could lead to a NULL pointer dereference (address 0x10) during process destruction, with a call trace through amdgpu_amdkfd_gpuvm_unmap...

CVE-2025-41713

During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a CPU-induced reset allows proper configuration...

Scattered Spider Resurfaces With Financial Sector Attacks Despite Retirement Claims

Cybersecurity researchers have tied a fresh round of cyber attacks targeting financial services to the notorious cybercrime group known as Scattered Spider, casting doubt on their claims of going "dark." Threat intelligence firm ReliaQuest said it has observed indications that the threat actor ha...

CVE-2025-35433: Insufficient Session Expiration

CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log in after a password reset. Fixed in 1.1.1...

CVE-2025-54390: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration ZCS when the zimbraFeatureResetPasswordStatus attribute is enabled. An attacker can exploit this by tricking an authenticated user into visiting a malicious webpage that silently...

CVE-2023-53367: Missing Release of Memory after Effective Lifetime

In the Linux kernel, the following vulnerability has been resolved: accel/habanalabs: fix mem leak in capture user mappings This commit fixes a memory leak caused when clearing the usermappings info when a new context is opened immediately after usermapping is captured and a hard reset is perform...

CVE-2023-53351: Use of Uninitialized Resource

In the Linux kernel, the following vulnerability has been resolved: drm/sched: Check scheduler work queue before calling timeout handling During an IGT GPU reset test we see again oops despite of commit 0c8c901aaaebc9 drm/sched: Check scheduler ready before calling timeout handling. It uses ready...

CVE-2025-54390

A Cross-Site Request Forgery CSRF vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration ZCS when the zimbraFeatureResetPasswordStatus attribute is enabled. An attacker can exploit this by tricking an authenticated user into visiting a malicious webpage that silently...

CVE-2025-54390

A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) . This issue occurs when the zimbraFeatureResetPasswordStatus attribute is enabled due to a lack of CSRF token validation on the endpoint. An attacker can exploit this by t...

CVE-2025-54390

A Cross-Site Request Forgery CSRF vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration ZCS when the zimbraFeatureResetPasswordStatus attribute is enabled. An attacker can exploit this by tricking an authenticated user into visiting a malicious webpage that silently...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to check the scheduler work queue, which could lead to a failure when the GPU is reset...

Zimbra Collaboration security vulnerabilities

Zimbra Collaboration is an open source enterprise-class email and collaboration platform from Zimbra, Inc. that supports email, calendaring, document management, and team collaboration features. A security vulnerability exists in Zimbra Collaboration that stems from a lack of CSRF token validatio...

CISA Thorium security vulnerabilities

CISA Thorium is a highly scalable distributed malware analysis and data generation framework for the U.S. Cybersecurity and Infrastructure Security Administration CISA government division. A security vulnerability exists in CISA Thorium versions prior to 1.1.1 that stems from not properly...

PT-2025-38217

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue within the accel/habanalabs component that results in a memory leak. This leak occurs when clearing user mappings information after a new context is...

PT-2025-49444

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists within the USB gadget f fs functionality. Specifically, a NULL pointer dereference can occur in the ffs func eps enable function when accessing epfile-ep after a...

PT-2025-38232

Name of the Vulnerable Software and Affected Versions: CISA Thorium versions prior to 1.1.1 Description: CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker possessing a previously used token could potentially log in after a password reset...

Linux Distros Unpatched Vulnerability : CVE-2025-39832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5: Fix lockdep assertion on sync reset unload event Fix lockdep assertion triggered during sync reset unload event. When the sync reset flow is initiated...