Linux kernel Heap Buffer Overflow DoS

The vulnerability of the setdeviceflags function in the net/bluetooth/mgmt.c module of Linux kernel relates to the unlocking of a mutex that has not been unlocked before. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE CVE-2024-57965

In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute'href',href call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability...

DEBIAN-CVE-2024-57965

In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute'href',href call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability...

Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync

...

smb: client: fix possible double free in smb2_set_ea()

...

Axios security vulnerabilities

Axios is an HTTP client based on Promise a solution for asynchronous programming from the Axios open source. A security vulnerability exists in Axios versions prior to 1.7.8 that stems from isURLSameOrigin.js not using a URL object to determine the origin and contains a potentially unwanted...

CVE-2024-48417

Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Cross Site Scripting XSS in : /bin/goahead via /goform/setStaticRoute, /goform/fromSetFilterUrlFilter, and /goform/fromSetFilterClientFilter...

TP-LINK TL-SG108E security vulnerabilities

TP-LINK TL-SG108E is a smart switch from China P&L TP-LINK. A security vulnerability exists in TP-Link TL-SG108E version 1.0.0 Build 20201208 Rel.40304, which stems from a parameter username/password in the file /usraccountset.cgi that can lead to the use of get request methods with sensitive que...

PT-2025-8789

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel related to the mptcp module, specifically in the mptcp pm nl fullmesh function. The issue allows the fullmesh flag to be set on...

PT-2025-8804

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the nilfs2 file system. The issue involves error handling in directory manipulation routines, specifically in nilfs set...

PT-2025-2376

Name of the Vulnerable Software and Affected Versions: Open5GS versions = 2.6.4 Description: A reachable assertion in the amf ue set suci function allows attackers to cause a Denial of Service DoS via a crafted NAS packet. Recommendations: For Open5GS versions = 2.6.4, update to a version greater...

ROS-20250121-03

Vulnerability The contentsecuritypolicy function of the Ruby interpreter's Action Pack extension is related to a vulnerability in the dynamically set Content-Security-Policy CSP headers. Content-Security-Policy CSP dynamically set headers vulnerability. Exploitation The vulnerability could allow ...

glibc/iconv Vulnerability (CVE-2024-2961)

PMASA-2025-3 Announcement-ID: PMASA-2025-3 Date: 2025-01-21 Summary glibc/iconv Vulnerability CVE-2024-2961 Description There was a vulnerability found in glibc/iconv that could potentially affect phpMyAdmin under specific circumstances. By default, phpMyAdmin is not vulnerable, but since we use...

DEBIAN-CVE-2023-52923

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from async garbage collection anymore, instea...

UBUNTU-CVE-2023-52923

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from async garbage collection anymore, instea...

DEBIAN-CVE-2025-21632

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before "getting" registers The x86 shadow stack support has its own set of registers. Those registers are XSAVE-managed, but they are "supervisor state components" which means that userspace...

UBUNTU-CVE-2025-21632

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before "getting" registers The x86 shadow stack support has its own set of registers. Those registers are XSAVE-managed, but they are "supervisor state components" which means that userspace...

Wavlink AC3000 Router Arbitrary Command Execution

The vulnerability of the setaddrouting function in the internet.cgi script of the Wavlink AC3000 WL-WN533A8 router microprogramming system is related to the lack of data cleaning at the control level when processing the netmask parameter. Exploiting this vulnerability allows a remote attacker to...

Wavlink AC3000 Router Arbitrary Command Execution

The vulnerability of the setsysinit function in the login.cgi script of the Wavlink AC3000 WL-WN533A8 router microprogramming system is related to the lack of data cleaning at the control level when processing the restarthourvalue parameter. Exploiting this vulnerability allows a remote attacker ...

Wavlink AC3000 Router Arbitrary Command Execution

The vulnerability of the setsysinit function in the login.cgi script of the Wavlink AC3000 WL-WN533A8 router microprogramming system is related to the lack of data cleaning at the control level when processing the restartweekvalue parameter. Exploiting this vulnerability allows a remote attacker ...