Syncfusion ej2-spreadsheet 安全漏洞

Syncfusion ej2-spreadsheet is a spreadsheet control from Syncfusion. A security vulnerability exists in Syncfusion ej2-spreadsheet version v27.2.2, which stems from the lib.setValue function containing a prototype contamination vulnerability...

glib: buffer overflow in set_connect_msg()

A flaw was found in the Glib library. A buffer overflow condition can be triggered in certain conditions due to an off-by-one error in SOCKS4CONNMSGLEN. This issue may lead to an application crash or other undefined behavior...

ALSA-2025:0936 Moderate: mingw-glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: buffer overflow in...

The vulnerability of the set_device_flags() function in the net/bluetooth/mgmt.c module of Linux kernel allows a hacker to trigger a service failure.

The vulnerability of the setdeviceflags function in the net/bluetooth/mgmt.c module of Linux kernel relates to the unlocking of a mutex that has not been unlocked before. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE CVE-2024-57965

In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute'href',href call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability...

DEBIAN-CVE-2024-57965

In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute'href',href call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability...

smb: client: fix possible double free in smb2_set_ea()

...

Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync

...

Axios 安全漏洞

Axios is an HTTP client based on Promise a solution for asynchronous programming from the Axios open source. A security vulnerability exists in Axios versions prior to 1.7.8 that stems from isURLSameOrigin.js not using a URL object to determine the origin and contains a potentially unwanted...

CVE-2024-48417

Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Cross Site Scripting XSS in : /bin/goahead via /goform/setStaticRoute, /goform/fromSetFilterUrlFilter, and /goform/fromSetFilterClientFilter...

TP-LINK TL-SG108E 安全漏洞

TP-LINK TL-SG108E is a smart switch from China P&L TP-LINK. A security vulnerability exists in TP-Link TL-SG108E version 1.0.0 Build 20201208 Rel.40304, which stems from a parameter username/password in the file /usraccountset.cgi that can lead to the use of get request methods with sensitive que...

ROS-20250121-03

Vulnerability The contentsecuritypolicy function of the Ruby interpreter's Action Pack extension is related to a vulnerability in the dynamically set Content-Security-Policy CSP headers. Content-Security-Policy CSP dynamically set headers vulnerability. Exploitation The vulnerability could allow ...

glibc/iconv Vulnerability (CVE-2024-2961)

PMASA-2025-3 Announcement-ID: PMASA-2025-3 Date: 2025-01-21 Summary glibc/iconv Vulnerability CVE-2024-2961 Description There was a vulnerability found in glibc/iconv that could potentially affect phpMyAdmin under specific circumstances. By default, phpMyAdmin is not vulnerable, but since we use...

DEBIAN-CVE-2023-52923

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from async garbage collection anymore, instea...

UBUNTU-CVE-2023-52923

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from async garbage collection anymore, instea...

DEBIAN-CVE-2025-21632

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before "getting" registers The x86 shadow stack support has its own set of registers. Those registers are XSAVE-managed, but they are "supervisor state components" which means that userspace...

UBUNTU-CVE-2025-21632

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before "getting" registers The x86 shadow stack support has its own set of registers. Those registers are XSAVE-managed, but they are "supervisor state components" which means that userspace...

The vulnerability of the set_sys_init() function in the login.cgi script of the Wavlink AC3000 router microprogramming system (WL-WN533A8) allows a hacker to execute arbitrary commands.

The vulnerability of the setsysinit function in the login.cgi script of the Wavlink AC3000 WL-WN533A8 router microprogramming system is related to the lack of data cleaning measures at the control level when processing the restartminvalue parameter. Exploiting this vulnerability allows a remote...

The vulnerability of the set_sys_init() function in the login.cgi script of the Wavlink AC3000 router microprogramming system (WL-WN533A8) allows a hacker to execute arbitrary commands.

The vulnerability of the setsysinit function in the login.cgi script of the Wavlink AC3000 WL-WN533A8 router microprogramming system is related to the lack of data cleaning at the control level when processing the restartweekvalue parameter. Exploiting this vulnerability allows a remote attacker ...

The vulnerability of the set_sys_init() function in the login.cgi script of the Wavlink AC3000 router microprogramming system (WL-WN533A8) allows a hacker to execute arbitrary commands.

The vulnerability of the setsysinit function in the login.cgi script of the Wavlink AC3000 WL-WN533A8 router microprogramming system is related to the lack of data cleaning at the control level when processing the restarthourvalue parameter. Exploiting this vulnerability allows a remote attacker ...