WordPress XMLRPC 3.9.2 Denial of Service

WordPress version 3.9.2 XMLRPC proof of concept denial of service exploit that leverages a vulnerability from 2014 and was originally discovered by Nir Goldshlager...

PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()

Impact Due to lack of limits by default in the explode function, malicious clients were able to abuse some packets to waste server CPU and memory. This is similar to a previous security issue published in https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672, but with a...

CVE-2025-27136

CVE-2025-27136 concerns LocalS3, a local S3 mock service. Multiple connected sources confirm that before version 1.21, the bucket creation endpoint processes CreateBucketConfiguration with an XML parser that resolves external entities. An attacker can declare an external entity to reference an in...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-53239)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53239 advisory. - In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Release resources at card...

CVE-2024-53694

A time-of-check time-of-use TOCTOU race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources. We have already fixed the vulnerability...

levnelyze.cz Open Redirect vulnerability OBB-4034308

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2025-0162 IBM Aspera Shares XML external entity injection

IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-0162

CVE-2025-0162 affects IBM Aspera Shares 1.9.9–1.10.0 PL7. The issue is an XML External Entity (XXE) injection in XML processing, enabling a remote authenticated attacker to disclose sensitive data or cause memory/resource exhaustion. Root cause: improper handling of external entities in XML. Docu...

Denial Of Service (DoS)

CGI is vulnerable to Denial of Service DoS. The vulnerability is due to the lack of a length limit on raw cookie values in the CGI::Cookie.parse method, allowing excessively large cookies to consume system resources...

The vulnerability of the Oracle Solaris operating system’s file system allows a perpetrator to gain privileged access to infrastructure resources or cause service interruptions.

The vulnerability of the Oracle Solaris operating system’s file system is related to reading data beyond the buffer boundaries of memory. Exploiting this vulnerability can allow an attacker to gain privileged access to infrastructure resources or cause service failures...

DEBIAN-CVE-2025-21829

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the warning "rxecleanup+0x12c/0x170 rdmarxe" The Call Trace is as below: " ? showregs.cold+0x1a/0x1f ? rxecleanup+0x12c/0x170 rdmarxe ? warn+0x84/0xd0 ? rxecleanup+0x12c/0x170 rdmarxe ? reportbug+0x105/0x180 ?...

CVE-2025-21829

CVE-2025-21829 affects the Linux kernel RDMArxe; a warning in __rxe_cleanup and rxe resource handling could cause improper resource release under high rdma load. The issue is resolved by a kernel fix that increases the timeout for rdma resource teardown, with commits in the stable/rxe flow (examp...

CVE-2025-21829 RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the warning "rxecleanup+0x12c/0x170 rdmarxe" The Call Trace is as below: " ? showregs.cold+0x1a/0x1f ? rxecleanup+0x12c/0x170 rdmarxe ? warn+0x84/0xd0 ? rxecleanup+0x12c/0x170 rdmarxe ? reportbug+0x105/0x180 ?...

CVE-2025-21829

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the warning "rxecleanup+0x12c/0x170 rdmarxe" The Call Trace is as below: " ? showregs.cold+0x1a/0x1f ? rxecleanup+0x12c/0x170 rdmarxe ? warn+0x84/0xd0 ? rxecleanup+0x12c/0x170 rdmarxe ? reportbug+0x105/0x180 ?...

CVE-2024-47259

Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing for a possible command injection leading to being able to transfer files to the Axis device with the purpose to exhaust system resources. Ax...

Vulnerability of the HID subsystem: The core kernels of the Linux operating system, which allow a hacker to trigger a service failure

Vulnerability of the HID subsystem: Linux operating system’s core is vulnerable due to the use of uninitialized resources. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the Intel Battery Life Diagnostic Tool, related to synchronization errors when using general resources, allows a hacker to exploit their privileges.

The vulnerability of the Intel Battery Life Diagnostic Tool relates to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain increased privileges...

cvp Incorrect Bailout Use-After-Free

In the function msmcvpmapbufwncc reachable from the EVAKMDREGISTERBUFFER ioctl, after cbuf is created and fully initialized, it is unconditionally added to the linked list inst-cvpwnccbufs.list. msmcvpmapbufwncc then tries to add an entry for the buffer to inst-cvpwnccbufstable. This can fail if...

Malicious code in grafana-resources-exporter-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32638374c532240fe824d5d3467c0adbbf3fc762b0efc727f36fc93271e9933b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of VMware ESXi and VMware Workstation relates to synchronization errors when using shared resources, allowing a hacker to execute arbitrary code.

The vulnerability of VMware ESXi and VMware Workstation lies in synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow an attacker to execute arbitrary code...