mtd: inftlcore: Add error check for inftl_read_oob()

...

Schneider Electric EcoStruxure IT Data Center Expert 安全漏洞

Schneider Electric EcoStruxure IT Data Center Expert is a scalable monitoring software from Schneider Electric France that collects, organizes, and distributes critical device information to provide a comprehensive view of devices. A security vulnerability exists in Schneider Electric EcoStruxure...

Moderate: Red Hat Security Advisory: satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-advisor-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. This adds the satellite/iop-advisor-engine-rhel9 image to the Red Hat container registry. To pull this container image, run the following command: podman pull...

DEBIAN-CVE-2025-38336

In the Linux kernel, the following vulnerability has been resolved: ata: patavia: Force PIO for ATAPI devices on VT6415/VT6330 The controller has a hardware bug that can hard hang the system when doing ATAPI DMAs without any trace of what happened. Depending on the device attached, it can also...

CVE-2025-44003

Missing Release of Resource after Effective Lifetime CWE-772 in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform a limited denial of service when 125 kHz Card Technology is enabled. This issue affects T-Series Readers: 9.20 prior to vCR9.20.250213a...

CVE-2025-44003

Missing Release of Resource after Effective Lifetime CWE-772 in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform a limited denial of service when 125 kHz Card Technology is enabled. This issue affects T-Series Readers: 9.20 prior to vCR9.20.250213a...

CVE-2025-44003

CVE-2025-44003 affects Gallagher T-Series Reader. A CWE-772 resource leak in the reader allows a limited denial of service when 125 kHz Card Technology is enabled, exploitable by someone with physical access. Affected versions include: prior to 9.20.250213a, prior to 9.10.250213a, prior to 9.00.2...

Gold Melody IAB Exploits Exposed ASP.NET Machine Keys for Unauthorized Access to Targets

The Initial Access Broker IAB known as Gold Melody has been attributed to a campaign that exploits leaked ASP.NET machine keys to obtain unauthorized access to organizations and peddle that access to other threat actors. The activity is being tracked by Palo Alto Networks Unit 42 under the monike...

Security Bulletin: Oracle Outside In Technology (OIT) security vulnerabilities in FileNet Content Manager (FNCM) Content Based Retrieval (CBR) content indexing

Summary Oracle Outside In Technology OIT CVE-2024-45492, CVE-2024-25269, CVE-2024-36052, CVE-2023-39743 security vulnerabilities in FileNet Content Manager FNCM Content Based Retrieval CBR content indexing. Vulnerability Details CVEID:CVE-2024-45492 DESCRIPTION: libexpat could allow a local...

CVE-2025-7077

A vulnerability classified as critical has been found in Shenzhen Libituo Technology LBT-T300-T310 up to 2.2.3.6. This affects the function config3gpara of the file /appy.cgi. The manipulation of the argument username3g/password3g leads to buffer overflow. It is possible to initiate the attack...

CVE-2025-7077 Shenzhen Libituo Technology LBT-T300-T310 appy.cgi config_3g_para buffer overflow

A vulnerability classified as critical has been found in Shenzhen Libituo Technology LBT-T300-T310 up to 2.2.3.6. This affects the function config3gpara of the file /appy.cgi. The manipulation of the argument username3g/password3g leads to buffer overflow. It is possible to initiate the attack...

Arbiter PUF: Uniqueness and Reliability Analysis Using Hybrid CMOS-Stanford Memristor Model

In an increasingly interconnected world, protecting electronic devices has grown more crucial because of the dangers of data extraction, reverse engineering, and hardware tampering. Producing chips in a third-party manufacturing company can let hackers change the design. As the Internet of Things...

Shenzhen Libituo Technology LBT-T300-T310 安全漏洞

Shenzhen Libituo Technology LBT-T300-T310 is an industrial router from Shenzhen Libituo Technology China. A security vulnerability exists in the Shenzhen Libituo Technology LBT-T300-T310 version 2.2.3.6 and earlier, which is caused by a buffer overflow due to the incorrect operation of the...

NightEagle APT Exploits Microsoft Exchange Flaw to Target China's Military and Tech Sectors

Cybersecurity researchers have shed light on a previously undocumented threat actor called NightEagle aka APT-Q-95 that has been observed targeting Microsoft Exchange servers as a part of a zero-day exploit chain designed to target government, defense, and technology sectors in China. According t...

Logic flaw vulnerability in DataEase of Hangzhou Feizhiyun Information Technology Co. Ltd (CNVD-2025-19437)

DataEase is open source data visualization and analysis tools. DataEase by Hangzhou Feizhiyun Information Technology Co. Ltd. has a logic flaw vulnerability that can be exploited by attackers to bypass authentication...

The Person in Charge of Testing Tech for US Spies Has Resigned

IARPA director Rick Muller is departing after just over a year at the R&D unit that invests in emerging technologies of potential interest to agencies like the NSA and the CIA, WIRED has learned...

A message from Bruce the mechanical shark

Welcome to this week's edition of the Threat Source newsletter. Hi, I'm Bruce, the 25-foot mechanical star of "Jaws." This summer marks 50 years since my 4 minutes of screentime kept people out of the water for decades. Maybe this Fourth of July weekend you're planning to sea-shanty your way to a...

CBP Wants New Tech to Search for Hidden Data on Seized Phones

Customs and Border Protection is asking companies to pitch tools for performing deep analysis on the contents of devices seized at the US border...

Big Tech’s Mixed Response to U.S. Treasury Sanctions

In May 2025, the U.S. government sanctioned a Chinese national for operating a cloud provider linked to the majority of virtual currency investment scam websites reported to the FBI. But a new report finds the accused continues to operate a slew of established accounts at American tech companies ...

The Promise and Peril of Digital Security in the Age of Dictatorship

LGBTIQ+ organizations in El Salvador are using technology to protect themselves and create a record of the country’s ongoing authoritarian escalations against their community. It’s not without risks...