Nextcloud: Users can modify tags on files that do not belong to them

A vulnerability was discovered in which users could modify tags on files that did not belong to them. This issue has been addressed...

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).

...

TIFF Image Development Platform Disclosure

The vulnerability of the TIFF Image development platform QNX SDP is related to an off-by-one error. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by the system’s security measures...

OESA-2025-1245 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: smscufx: Fix null-ptr-deref in ufxusbprobe I got a null-ptr-deref report: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP:...

CVE-2025-27498

aes-gcm is a pure Rust implementation of the AES-GCM. In decryptinplacedetached, the decrypted ciphertext which is the correct ciphertext is exposed even if the tag is incorrect. This is because in decryptinplace in asconcore.rs, tag verification causes an error to be returned with the plaintext...

com.parallels:parallels-desktop (>=0.4, <=0.6), org.fedoraproject.jenkins.plugins:copr (0.6.1) +7 more potentially affected by CVE-2025-27623 via org.jenkins-ci.main:jenkins-core (1.651.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.651.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.parallels:parallels-desktop =0.4, =1.6, =0.7.0, =0.8.1 Source cves: CVE-2025-27623 Source...

com.parallels:parallels-desktop (>=0.4, <=0.6), org.fedoraproject.jenkins.plugins:copr (0.6.1) +7 more potentially affected by CVE-2025-27624 via org.jenkins-ci.main:jenkins-core (1.651.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.651.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.parallels:parallels-desktop =0.4, =1.6, =0.7.0, =0.8.1 Source cves: CVE-2025-27624 Source...

org.jenkins-ci.main:jenkins-test-harness (1.565.1), org.jenkins-ci.main:jenkins-war (1.565.1) +10 more potentially affected by CVE-2025-27623 via org.jenkins-ci.main:jenkins-core (1.565.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.565.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.565.1 - org.jenkins-ci.main:jenkins-war 1.565.1 -...

org.jenkins-ci.main:jenkins-test-harness (1.565.1), org.jenkins-ci.main:jenkins-war (1.565.1) +10 more potentially affected by CVE-2025-27622 via org.jenkins-ci.main:jenkins-core (1.565.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.565.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.565.1 - org.jenkins-ci.main:jenkins-war 1.565.1 -...

Linux Distros Unpatched Vulnerability : CVE-2024-53097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm: krealloc: Fix MTE false alarm in dokrealloc This patch addresses an issue introduced by...

Linux Distros Unpatched Vulnerability : CVE-2024-50244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Additional check in niclear Checking of NTFSFLAGSLOGREPLAYING added to prevent...

Linux Distros Unpatched Vulnerability : CVE-2024-57896

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount During the unmount path, at closectree, we first stop the cleaner kthread,...

Important: amazon-cloudwatch-agent

Issue Overview: Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. CVE-2024-34155 Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a...

Security update for gstreamer-plugins-base

This update for gstreamer-plugins-base fixes the following issues: CVE-2024-47538: Fixed stack-buffer overflow in vorbishandleidentificationpacket bsc1234415. CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser bsc1234450. CVE-2024-47600: Fixed Out-of-bounds read in...

Linux Distros Unpatched Vulnerability : CVE-2022-1769

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974. CVE-2022-1769 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2024-37021

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpga: manager: add owner module and take its refcount The current implementation of the fpga manager assumes that the low-level module registers a driver for th...

Linux Distros Unpatched Vulnerability : CVE-2023-37788

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service DoS via unspecified vectors. CVE-2023-37788 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2021-38561

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is...

LibreOffice Arbitrary Script Execution Vulnerability (Mar 2025) - Windows

LibreOffice is prone to an arbitrary script execution vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross-Site Scripting (XSS)

dom-expressions is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the use of .replace with special replacement patterns $' or $\ in user-defined attributes of the Meta tag, allows an attackers can exploit this by injecting malicious payloads into meta tags, potentially...