CVE-2023-53216

CVE-2023-53216 affects the Linux kernel on ARM64 where EFI runtime services could sleep in an invalid context due to the new efi_rt_lock spinlock. The root cause is the addition of a spinlock (efi_rt_lock) introduced by commit ff7a167961d1 to execute EFI runtime services from a dedicated stack, w...

CVE-2023-53216 arm64: efi: Make efi_rt_lock a raw_spinlock

In the Linux kernel, the following vulnerability has been resolved: arm64: efi: Make efirtlock a rawspinlock Running a rt-kernel base on 6.2.0-rc3-rt1 on an Ampere Altra outputs the following: BUG: sleeping function called from invalid context at kernel/locking/spinlockrt.c:46 inatomic: 1,...

MAL-2025-47196 Malicious code in ng2-file-upload (npm)

The package ng2-file-upload was found have been identified as potentially malicious due to the inclusion of a minified postinstall script. It is considered suspicious because: The script appears to attempt to steal access tokens for npm, GitHub, AWS, GCP, etc. There is no changelog or new tags in...

CVE-2025-10429

A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajaxproduct.php. The manipulation of the argument dropservices results in sql injection. The attack can be launched remotely. The...

CVE-2025-10429

A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajaxproduct.php. The manipulation of the argument dropservices results in sql injection. The attack can be launched remotely. The...

CVE-2025-10429 SourceCodester Pet Grooming Management Software ajax_product.php sql injection

A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajaxproduct.php. The manipulation of the argument dropservices results in sql injection. The attack can be launched remotely. The...

About the security content of macOS Sonoma 14.8

About the security content of macOS Sonoma 14.8 This document describes the security content of macOS Sonoma 14.8. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases ar...

PT-2025-37825

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Sequoia 15.7 macOS versions prior to Sonoma 14.8 macOS versions prior to Tahoe 26 Description: An application may be able to access protected user data. The issue was resolved by blocking unsigned services from launchi...

SourceCodester Pet Grooming Management Software SQL注入漏洞

SourceCodester Pet Grooming Management Software is an open source pet grooming management system from SourceCodester. SourceCodester Pet Grooming Management Software version 1.0 suffers from a SQL injection vulnerability that stems from incorrect manipulation of the parameter dropservices in the...

PT-2025-37453

Name of the Vulnerable Software and Affected Versions: SourceCodester Pet Grooming Management Software version 1.0 Description: A SQL injection issue exists in SourceCodester Pet Grooming Management Software. The vulnerability is located in an unknown functionality within the /admin/ajax...

About the security content of macOS Tahoe 26

About the security content of macOS Tahoe 26 This document describes the security content of macOS Tahoe 26. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

About the security content of macOS Sequoia 15.7

About the security content of macOS Sequoia 15.7 About the security content of macOS Sequoia 15.7. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

PT-2025-37657

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.2.0-rc3-rt1 Description: A flaw exists in the Linux kernel related to the EFI runtime services. Specifically, the efi rt lock spinlock could lead to preemption issues when called from within EFI runtime...

PrivExchange

This is a proof-of-concept PoC tool for abusing Microsoft Exchange to obtain Domain Admin privileges. The tool, named PrivExchange, requires the Impacket library and can be used to subscribe to push notifications on Exchange Web Services, which will make Exchange connect back to the attacker and...

teler-waf

This repository is an open-source Go HTTP middleware called teler-waf, which protects local web services from various threats, including OWASP Top 10 vulnerabilities, malicious actors, botnets, and brute force attacks. The repository contains a variety of files, including issue templates, pull...

wazuh

This repository is an open-source security platform called Wazuh, which provides unified XDR and SIEM protection for endpoints and cloud workloads. The repository contains various files and templates for issue reporting, testing, and integration with external services. The probable entry points f...

CVE-2025-10389 CRMEB Administrator Password SystemAdminServices.php save improper authorization

A security flaw has been discovered in CRMEB up to 5.6.1. Impacted is the function Save of the file app/services/system/admin/SystemAdminServices.php of the component Administrator Password Handler. Performing manipulation of the argument ID results in improper authorization. The attack may be...

CVE-2025-10389 CRMEB Administrator Password SystemAdminServices.php save improper authorization

A security flaw has been discovered in CRMEB up to 5.6.1. Impacted is the function Save of the file app/services/system/admin/SystemAdminServices.php of the component Administrator Password Handler. Performing manipulation of the argument ID results in improper authorization. The attack may be...

CVE-2025-10389

CVE-2025-10389 affects CRMEB up to version 5.6.1. The vulnerability is in the Save function of app/services/system/admin/SystemAdminServices.php (Administrator Password Handler). Manipulating the ID argument can lead to improper authorization, with remote exploitation possible. Multiple sources c...

CVE-2025-43789

JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies get executed...