TOTOLINK N150RT LAN Settings Page Component Cross-Site Scripting Vulnerability

The TOTOLINK N150RT is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK N150RT version 3.4.0-B20190525 suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data by the parameter Hostname in the...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other features. A security vulnerability exists in F5 BIG-IP that stems from RFC compliance configuration leading to TMM termination...

PT-2025-20041 · Samsung · Galaxy Watch

Name of the Vulnerable Software and Affected Versions: Galaxy Watch versions prior to SMR May-2025 Release 1 Description: The issue concerns the improper export of Android application components in the Settings of the Galaxy Watch, allowing physical attackers to access developer settings...

Configure TIME_WAIT for TCP

TIMEWAIT indicates the time for TCP to wait for connection destruction. If this parameter is set to a large value, a large number of TCP connections are not closed and DoS attacks occur. You are advised to set this parameter to a value less than or equal to 60. SPDX-FileCopyrightText: 2025...

Configure Kernel Parameter kptr_restrict Properly

kptrrestrict is used to protect kernel symbol addresses. When the protection level is low, common users can obtain kernel symbol addresses, which are easy to be exploited by attackers. This increases the attack surface and reduces system security. Currently, kptrrestrict can be set to any of the...

Do Not Use Historical Passwords

Using the same historical password frequently may cause password leakage and attacks. To ensure user security, the function of disabling historical passwords must be configured. The number of historical passwords that cannot be used must be properly set based on the actual service scenario. The...

Do Not Preset known_hosts for the SSH Service

knownhosts stores the public keys of the computers that the host has accessed. After a user successfully logs in to another computer, the public key information is automatically saved in $HOME/.ssh/knownhosts. When the same computer is accessed next time, its public key is verified. If the...

SAMSUNG SMR 安全漏洞

SAMSUNG SMR is a system patch package from the South Korean company Samsung SAMSUNG. It provides patches for Samsung mobile applications. SAMSUNG SMR suffers from a security vulnerability that stems from improper export of Android application components in Settings, which could lead to a physical...

SonicWALL SMA100 安全漏洞

The SonicWall SMA100 is a secure access gateway appliance from SonicWall USA. A path traversal vulnerability exists in the SonicWall SMA100, which can be exploited by an attacker to delete arbitrary files, resulting in a reboot of factory settings...

XenServer - VMs on a Cisco USC host do not receive the DHCP settings

When running VMs on a XenServer 8.4 host running on Cisco UCS hardware, the VMs do not receive the DHCP settings...

Do Not Preset authorized_keys for the SSH Service

authorizedkeys specifies the public key of the remote host. You can store the public key in the $HOME/.ssh/authorizedkeys file in the home directory for public key authentication. Then you can directly log in to the system. If authorizedkeys is preset in the system and public and private key...

Ensure That a User Is Locked After a Specified Number of Login Failures

If a user fails to log in to the system for a specified number of consecutive times, the system locks the user. That is, the user is not allowed to log in to the system for a specified period of time to prevent malicious system password cracking. During the lockout period, any input is considered...

WordPress plugin Search Exclude 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-19996

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 14.2.24 and versions 15.0.0 through 15.1.6 Description Next.js, a React framework for building full-stack web applications, contains a race-condition issue affecting the Pages Router under specific misconfigurations...

CVE-2025-3513

The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13420

Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsfresetsectionoptions', 'gsfresetsectionoptions', 'gsfcreatepresetoptions' and more in various versions. This makes it possible for authenticated...

CVE-2025-3502

The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-3504

The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13381

The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

SUSE CVE-2022-49869

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix possible crash in bnxthwrmsetcoal During the error recovery sequence, the rtnllock is not held for the entire duration and some datastructures may be freed during the sequence. Check for the BNXTSTATEOPEN flag instead...