PT-2025-4819 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to the latest supported version Description: The issue concerns the use of End-of-Life EOL versions of Node.js, which are no longer supported and do not receive updates, including security patches. This may expose syste...

PT-2025-1411 · Open5Gs · Open5Gs Mme

Name of the Vulnerable Software and Affected Versions: Open5GS MME versions prior to 2.6.4 Description: The issue allows an attacker to send a malformed ASN.1 packet over the S1AP interface, triggering an assertion that can cause the MME to crash repeatedly, resulting in denial of service. This c...

.NET 9.0 Update - January 14, 2025 (KB5050526)

None None...

.NET 8.0 Update - January 14, 2025 (KB5050525)

None None...

Wireshark SEoL (1.3.x <= x <= 1.4.x)

According to its version, Wireshark is between 1.3.x and 1.4.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVE...

Wireshark SEoL (1.10.x)

According to its version, Wireshark is 1.10.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable...

GHSA-J3F9-P6HM-5W6Q Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

Impact Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers...

Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

Impact Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers...

DEBIAN-CVE-2024-56760

In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Handle lack of irqdomain gracefully Alexandre observed a warning emitted from pcimsisetupmsiirqs on a RISCV platform which does not provide PCI/MSI support: WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121...

PT-2026-4370

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's RDMA/core component related to reference counting within the ib del sub device and put function. Specifically, the code fails to drop a device referen...

The vulnerability of the mptcp component in Linux kernel, which allows a hacker to cause a service failure

The vulnerability of the mptcp component in Linux operating systems is related to the assignment of the NULL pointer in the mptcpsupportedsockopt function. Exploiting this vulnerability can allow a hacker to cause a service failure...

CVE-2024-39162

pyspider through 0.3.10 allows /update XSS. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2024-39162

pyspider through 0.3.10 allows /update XSS. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

DEBIAN-CVE-2024-53060

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported acpievaluateobject may return AENOTFOUND failure, which would result in dereferencing buffer.pointer obj while being NULL. Although this case may be unrealisti...

PT-2024-8246

Name of the Vulnerable Software and Affected Versions GeoVision GV-VS12 versions GeoVision GV-VS11 versions GeoVision GV-DSP LPR V3 versions GeoVision GVLX 4 V2 versions GeoVision GVLX 4 V3 versions Description The issue is related to an OS Command Injection vulnerability in certain end-of-life E...

kernel: i915/perf: Fix NULL deref bugs with drm_dbg() calls

In the Linux kernel, the following vulnerability has been resolved: i915/perf: Fix NULL deref bugs with drmdbg calls When i915 perf interface is not available dereferencing it will lead to NULL dereferences. As returning -ENOTSUPP is pretty clear return when perf interface is not available...

Microsoft Windows Telephony Server 安全漏洞

Microsoft Windows Telephony Server is a component of Microsoft Corporation USA that supports the Telephony Application Programming Interface TAPI, which allows computer programs to communicate with shared telephony services. A security vulnerability exists in Microsoft Windows Telephony Server. A...

CVE-2024-50182 secretmem: disable memfd_secret() if arch cannot set direct map

In the Linux kernel, the following vulnerability has been resolved: secretmem: disable memfdsecret if arch cannot set direct map Return -ENOSYS from memfdsecret syscall if !cansetdirectmap. This is the case for example on some arm64 configurations, where marking 4k PTEs in the direct map not...

CVE-2024-9165 Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Gift Cards Gift Vouchers and Packages WooCommerce Supported plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

...