CVE-2025-22041

The CVE-2025-22041 issue affects the Linux kernel ksmbd subsystem. In multichannel mode, a use-after-free can occur in ksmbd_sessions_deregister() when a second channel creates a session via the first channel’s connection, causing a freed session in the global session table to be dereferenced via...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the reuse of the ksmbdsessionsderegister function after release...

Explore how to secure AI by attending our Learn Live Series

As organizations develop, use, and increasingly rely on AI applications, they must address new and amplified security risks. Are you prepared to secure your environment for AI adoption? How about identifying threats to your AI and safeguarding data? Register to attend one or all our Learn Live...

CVE-2024-49709

Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to user's browser might set such a cookie, wait until the user logs in and then use the same cookie to take over the account. Moreover, the system does not...

Director is not showing correct number of active sessions

Director is not showing correct number of active sessions. Number of active session in Studio console does not match with Director - Filters -Sessions option...

LogonUI.exe process hanging after logoff from multi-session VDA

When utilizing multi-session VDA with the Duo Security agent installed, users may close out the applications in an attempt to log off of the VDA but the LogonUI.exe process will hang. This will result in multiple Terminal Services sessions showing active with the same session number, but no user...

Citrix Client redirected printers missing print vendor specific configurations

The customer observed some users reported that client printers mapped into their Citrix sessions were missing printer specific configurations. The most common reported issue from users in this case was that the second printer tray was not available when using Citrix published applications. Window...

PT-2025-14952 · Unknown · Showeblogin Social

Name of the Vulnerable Software and Affected Versions: Showeblogin Social versions n/a through 7.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker could...

CVE-2025-20212

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series devices could allow an authenticated, remote attacker to cause a denial of service DoS condition in the Cisco AnyConnect service on an affected device. To exploit this vulnerability, the attacker must...

Preview the Action: Two New Sessions Available Before Take Command 2025

Take Command 2025 is packed with insights from cybersecurity experts, threat intelligence leaders, and hands-on practitioners. But you don’t have to wait until April 9 to start learning. Two exclusive sessions are now available on-demand — giving you early access to critical content designed to...

AZL-59350 CVE-2025-30211 affecting package erlang for versions less than 25.3.2.20-1

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names 64 characters provided in K...

UBUNTU-CVE-2025-30211

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names 64 characters provided in K...

CVE-2025-29928 authentik's deletion of sessions did not revoke sessions when using database session storage

authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage which is a non-default setting, deleting sessions via the Web Interface or the API would not revoke the session and the session holder wou...

CVE-2025-2863

Cross-site request forgery CSRF vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend ...

CVE-2025-2863

The CVE-2025-2863 entry concerns a CSRF vulnerability in saTECH BCU firmware version 2.1.3. The issue could let an unauthenticated local attacker hijack active administrator sessions and trigger actions such as rebooting the device or changing roles/permissions, depending on the logged-in user. T...

CVE-2024-10718

In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information. The issue is fixed in version 1.7.0...

[SECURITY] Fedora 40 Update: kitty-0.40.0-2.fc40

Offloads rendering to the GPU for lower system load and buttery smooth scrolling. Uses threaded rendering to minimize input latency. - Supports all modern terminal features: graphics images, unicode, true-col or, OpenType ligatures, mouse protocol, focus tracking, bracketed paste and several new...

GHSA-W6HH-W36C-VXMW LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality

mudler/localai version v2.21.1 contains a Cross-Site Scripting XSS vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts...

CVE-2024-9900

LocalAI (github.com/mudler/LocalAI) is affected by a Cross-Site Scripting (XSS) vulnerability in its search functionality. The CVE-2024-9900 entry cites v2.21.1 as vulnerable, due to improper sanitization of user input, enabling injection and execution of arbitrary JavaScript in the victim’s brow...

CVE-2024-42176

HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a single credential allowing an attacker to potentially obtain access to a user's account or sensitive information...