CVE-2024-41169 Apache Zeppelin: raft directory listing and file read

The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue by removin...

CVE-2025-52950

Juniper Networks Security Director has a Missing Authorization vulnerability (CVE-2025-52950) where an unauthenticated network-based attacker can read or tamper with sensitive resources through the web interface. The issue arises from endpoints that do not validate authorization, allowing access ...

The vulnerability of Websoft HCM’s automation software for HR processes stems from the use of open redirection. This allows attackers to redirect users to any arbitrary URL address.

The vulnerability of Websoft HCM’s automation software for HR processes is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to redirect users to any arbitrary URL address from a remote location...

The vulnerability of the Windows QoS Scheduler Driver, which allows attackers to increase their privileges on Windows operating systems

The vulnerability of the Windows QoS Scheduler Driver affects operating systems with Windows, and it is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to gain increased privileges...

SUSE-SU-2025:02280-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2025-46701: Fixed refactor CGI servlet to access resources via WebResources bsc1243815. - CVE-2025-48988: Fixed limits the total number of parts in a multi-part request and limits the size of the headers provided with each part bsc1244656. ...

The vulnerability of Websoft HCM’s automation software for HR processes stems from insufficient validation of input data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Websoft HCM’s automation software for HR processes is related to insufficient verification of entered data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by sending a specially crafted XQuery quer...

SUSE-SU-2025:02261-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: - Fixed refactor CGI servlet to access resources via WebResources bsc1243815. - Fixed limits the total number of parts in a multi-part request and limits the size of the headers provided with each part bsc1244656. - Fixed expand checks for...

Vulnerability of the shmemFetchNotification() function in the drivers/firmware/arm_scmi/common.h module – a driver for supporting Linux kernel patches, which allows an attacker to trigger a service failure

Vulnerability of the shmemFetchNotification function in the drivers/firmware/armscmi/common.h module – The driver for handling Linux kernel patches is vulnerable to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the wcd9335 codec not releasing regulator resources, which could lead to a resource leak...

Possible Denial of Service in resolv gem

A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby. This vulnerability has been assigned the CVE identifier CVE-2025-24294. We recommend upgrading the resolv gem. Details The vulnerability is caused by an insufficient check on the length of a decompressed...

The vulnerability of the Device Admin App operating system ctrlX OS allows a perpetrator to select user account names.

The vulnerability of the Device Admin App on the ctrlX OS involves unlimited distribution of resources. Exploiting this vulnerability allows a malicious actor to select user account names by sending specially crafted HTTP requests remotely...

Vulnerability of the drm_mode_page_flip_ioctls function in the drivers/gpu/drm/drm_plane.c module – A driver for supporting Direct Rendering Infrastructure (DRI) in the Linux operating system, which allows a hacker to trigger a service failure.

Vulnerability of the drmmodepageflipioctls function in the drivers/gpu/drm/drmplane.c module – The Linux kernel’s Direct Rendering Infrastructure DRI driver has vulnerabilities related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to...

Qualcomm Chipsets 资源管理错误漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A resource management error vulnerability exists in Qualcomm Chipsets that originates from a memory corruption that occurs when processing cleanup to free resources during a subsystem reboot...

Vulnerability of the Server component: The Optimizer component of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the Oracle MySQL Server component of the database management system’s optimizer is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

PT-2025-28054 · Undefined · Undefined

CVE-2025-0654 Rejected reason https://t.co/bkRtGoOT8j Don't wait vulnerability scanning results: https://t.co/oh1APvMMnd...

CVE-2023-50786

CVE-2023-50786 affects Dradis 4.16.0 and earlier, where references to external HTTPS images are allowed instead of forcing embedded images. This can enable an authorized author to attempt theft of Net-NTLM hashes from other authors on a Windows domain network. Remediation: upgrade to a version th...

CVE-2025-5953

The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajaxinsertemployee and updateempoyee functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $POST'role' and, after basic cleaning via...

The vulnerability of the FreeScout support service management system, related to synchronization errors when using shared resources, allows a hacker to trigger a service failure.

The vulnerability of the FreeScout support service management system is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker operating remotely to cause a service failure...

The vulnerability in the fs/f2fs/file.c component of the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability in the fs/f2fs/file.c component of the Linux operating system is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

We Urgently Need Privilege Management in MCP: a Measurement of API Usage in MCP Ecosystems

The Model Context Protocol MCP has emerged as a widely adopted mechanism for connecting large language models to external tools and resources. While MCP promises seamless extensibility and rich integrations, it also introduces a substantially expanded attack surface: any plugin can inherit broad...