PT-2025-6689

Name of the Vulnerable Software and Affected Versions GRUB2 affected versions not specified Description The issue arises when reading the language .mo file in grub mofile open, where GRUB2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead the...

The vulnerability of the Range Request Forward function in the Cisco AsyncOS operating system of Cisco Secure Web Appliances allows attackers to circumvent security restrictions and write arbitrary files.

The vulnerability of the Range Request Forward function in the Cisco AsyncOS operating system of Cisco Secure Web Appliances is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and write arbitrary files...

Samsung Blockchain Keystore Out-of-Bounds Write Vulnerability

Samsung Blockchain Keystore is a secure storage solution introduced by South Korea's Samsung SAMSUNG on its mobile devices to protect users' blockchain keys and digital assets. Samsung Blockchain Keystore suffers from an out-of-bounds write vulnerability that can be exploited by an attacker to...

Ivanti Secure Access Client Privilege Issue Vulnerability

Ivanti Secure Access Client is a security software client developed by Ivanti, Inc. to enable remote secure access, supporting enterprise-class VPN connections and encrypted access to resources. Ivanti Secure Access Client suffers from a privilege issue vulnerability that can be exploited by an...

The vulnerability of Ivanti Connect Secure and Ivanti Policy Secure network access control tools lies in improper external management of file names or paths, allowing attackers to write arbitrary files.

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure network access control tools is related to improper external management of file names or file paths. Exploiting this vulnerability allows a malicious actor to write arbitrary files...

CVE-2025-25286

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

CVE-2024-4282

Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22...

Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security

WordPress CVE-2024-10924 Exploit 📌 Overview This repository...

SUSE CVE-2023-31347

Due to a code bug in SecureTSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when Secure TSC is enabled potentially resulting in a loss of guest integrity...

SUSE CVE-2023-34049

The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script wi...

SUSE CVE-2024-2756

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications...

[SECURITY] Fedora 41 Update: openssl-3.2.4-1.fc41

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols...

[SECURITY] Fedora 41 Update: krb5-1.21.3-4.fc41

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form...

Ivanti Policy Secure 22.x < 22.7R1.3 RCE

The Ivanti Policy Secure installed on the remote host is prior to 22.7R1.3. It is, therefore, affected by multiple vulnerabilities in the admin portal: - External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remo...

Ivanti Connect Secure < 22.7R2.6 Multiple Vulnerabilities

The Ivanti Connect Secure installed on the remote host is prior to 22.7R2.6. It is, therefore, affected by multiple vulnerabilities in the admin portal: - External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a...

Ivanti Connect Secure 22.x < 22.7R2.3

The Ivanti Connect Secure installed on the remote host is prior to 22.7R2.3. It is, therefore, affected by a information disclosure vulnerability in the admin portal. A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local...

Ivanti Connect Secure 22.x < 22.7R2.4 Multiple Vulnerabilities

The Ivanti Connect Secure installed on the remote host is prior to 22.7R2.4. It is, therefore, affected by multiple vulnerabilities in the admin portal: - External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a...

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure access control tools lies in the lack of measures taken to protect the website structure. This allows attackers to enhance their privileges and perform cross-site scripting attacks.

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure access control tools is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to enhance their privileges and perform cross-site scripting attacks...

The vulnerability of the Ivanti Connect Secure access control tool, related to reading data outside the buffer in memory, allows a intruder to execute arbitrary code.

The vulnerability of the Ivanti Connect Secure access control tool lies in the reading of data outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2025-24888

The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to version 0.14.1, a malicious SecureDrop Server could obtain code execution on the SecureDrop Client virtual machine sd-app. SecureDrop Server...