CVE-2025-48499

Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP Internet Printing Protocol or LPD Line Printer Daemon packet may cause a denial-of-service DoS condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service D...

Fixed in Apache Tomcat 9.0.108

Important: DoS in HTTP/2 due to client triggered stream reset CVE-2025-48989 Tomcat's HTTP/2 implementation was vulnerable to the made you reset attack. The denial of service typically manifested as an OutOfMemoryError. This was fixed with commit f36b8a4e. This issue was reported to the ASF...

Linux Distros Unpatched Vulnerability : CVE-2024-35994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: Fix memory related IO errors and crashes It turns out that while...

Fixed in Apache Tomcat 11.0.10

Important: DoS in HTTP/2 due to client triggered stream reset CVE-2025-48989 Tomcat's HTTP/2 implementation was vulnerable to the made you reset attack. The denial of service typically manifested as an OutOfMemoryError. This was fixed with commit f362c8eb. This issue was reported to the ASF...

Linux Distros Unpatched Vulnerability : CVE-2025-38091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check stream id dml21 wrapper to get planeid Why & How Fix a false positive...

CVE-2025-48499

CVE-2025-48499 is an out-of-bounds write vulnerability in FUJIFILM Business Innovation MFPs. A specially crafted IPP or LPD packet can cause a denial-of-service (DoS) on affected devices; recovery requires an MFP reset. Several connected sources confirm the issue and, in at least one entry, advis...

WordPress Sala Theme 1.1.4 Privilege Escalation

WordPress Sala Theme versions 1.1.4 and below are vulnerable to an unauthenticated privilege escalation vulnerability. This flaw allows unauthenticated attackers to reset passwords of arbitrary users — including administrators — by directly invoking an exposed AJAX endpoint without verifying the...

CVE-2024-34327

Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form...

CVE-2025-1221

A Zigbee Radio Co-Processor RCP, which is using SiLabs EmberZNet Zigbee stack, was unable to send messages to the host system CPCd due to heavy Zigbee traffic, resulting in a Denial of Service DoS attack, Only hard reset will bring the device to normal operation...

CVE-2025-8468

A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /controllers/reset.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has...

OESA-2025-1927 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: pcigeneric: Use pcitryresetfunction to avoid deadlock There are multiple places from where the recovery work gets scheduled asynchronously. Also,...

OESA-2025-1926 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: pcigeneric: Use pcitryresetfunction to avoid deadlock There are multiple places from where the recovery work gets scheduled asynchronously. Also,...

CVE-2025-8286

CVE-2025-8286 affects Güralp FMUS series seismic monitoring devices. The vulnerability is an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device. Affected products are exposed via a networ...

CVE-2024-34327

Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form...

CVE-2024-34327

Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form...

CVE-2014-125122 Linksys WRT120N tmUnblock.cgi Stack-Based Buffer Overflow Admin Password Reset

A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router. The vulnerability is triggered by sending a specially crafted HTTP POST request with an overly long TMBlockURL parameter to the endpoint. By exploiting this flaw, an...

CVE-2014-125122

CVE-2014-125122 affects Linksys WRT120N: a stack-based buffer overflow in the tmUnblock.cgi endpoint, triggered by a specially crafted POST with an overly long TM_Block_URL, allows an unauthenticated attacker to overwrite memory and temporarily reset the admin password to blank, gaining access to...

CVE-2014-125122 Linksys WRT120N tmUnblock.cgi Stack-Based Buffer Overflow Admin Password Reset

A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router. The vulnerability is triggered by sending a specially crafted HTTP POST request with an overly long TMBlockURL parameter to the endpoint. By exploiting this flaw, an...

CVE-2025-7689

The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhbresetpasswordcallback function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the password o...

Sielox AnyWare 安全漏洞

Sielox AnyWare is an access control system from Sielox USA. A security vulnerability exists in Sielox AnyWare version v2.1.2, which stems from an unvalidated email address field in the password reset form, which could lead to SQL injection...