Improper Verification Of Cryptographic Signature

Apache Spark is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to the use of an unauthenticated default encryption cipher AES/CTR/NoPadding for RPC communication when spark.network.crypto.enabled is true and no cipher is explicitly configured, which allow...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-53174)

SUNRPC: The function cshow was called with protection from RCU. This only ensures that cp will not be freed. Therefore, the reference count for cp can drop to zero, which will trigger a refcount use-after-free warning when cacheget is called. This plugin only works with Tenable.ot. Please visit...

EUVD-2025-124954

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-length checksum In xdrstreamdecodeopaqueauth, zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gsskrb5verifymicv2...

CVE-2025-40129

CVE-2025-40129 affects the Linux kernel sunrpc subsystem. A null pointer dereference could occur in gss_krb5_verify_mic_v2 due to a zero-length checksum in xdr_stream_decode_opaque_auth(), where checksum.data could be NULL when checksum.len

CVE-2025-40129

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-length checksum In xdrstreamdecodeopaqueauth, zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gsskrb5verifymicv2...

kernel: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails

In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfsfsprocnetinit fails. syzbot reported a warning below 1 following a fault injection in nfsfsprocnetinit. 0 When nfsfsprocnetinit fails, /proc/net/rpc/nfs is not removed. Later, rpcprocexit...

BIT-OPENTELEMETRY-COLLECTOR-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990278)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990278 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: make sure cache entry active before cacheshow The function cshow was called with protecti...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990063 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988861)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988861 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svctcplistendataready After the listener svcsock is freed, and before invoking...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989421)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989421 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svctcplistendataready After the listener svcsock is freed, and before invoking...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990363)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990363 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4openowner leak when concurrent nfsd4open occur The action force umountumount -f wil...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990032)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990032 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988943)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988943 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4: Don't hold the layoutget locks across multiple RPC calls When doing layoutget as part of t...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988809)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988809 advisory. In the Linux kernel, the following vulnerability has been resolved: memory: renesas-rpc-if: fix platform-device leak in error path Make sure to free the flash platfo...

OESA-2025-2556 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved:sunrpc: fix one UAF issue caused by sunrpc kernel tcp socketBUG: KASAN: slab-use-after-free in tcpwritetimerhandler+0x156/0x3e0Read of size 1 at addr...

Linux Distros Unpatched Vulnerability : CVE-2025-40090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix recursive locking in RPC handle list access Since commit 305853cce3794 ksmbd: Fix...

CVE-2023-7325

CVE-2023-7325 affects Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10. The vulnerability is a server-side request forgery (SSRF) in the xmlrpc.sock handler that accepts crafted XML-RPC requests to reach internal unix socket RPC endpoints and execute privileg...

CVE-2023-7325 Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF

Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery SSRF vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix...

CVE-2025-40090

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix recursive locking in RPC handle list access Since commit 305853cce3794 "ksmbd: Fix race condition in RPC handle list access", ksmbdsessionrpcmethod attempts to lock sess-rpclock. This causes hung connections / tasks wh...