Vulnerabilities that aren’t. Cross Site Tracing / XST

This is the first of my posts that explain why some common security vulnerabilities are most likely not real threats. They should be treated as security enhancements rather than vulnerabilities. Bearing in mind the number of scanning tools that rate such vulnerabilities as "high" its no wonder...

libbpf:bpf-object-fuzzer: Segv on unknown address in unsigned long fuzzer::ForEachNonZeroByte<unsigned long fuzzer::TracePC::CollectF

Detailed Report: https://oss-fuzz.com/testcase?key=6288192473530368 Project: libbpf Fuzzing Engine: libFuzzer Fuzz Target: bpf-object-fuzzer Job Type: libfuzzermsanlibbpf Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: unsigned long...

libssh2:ssh2_client_fuzzer: Null-dereference READ in ubsan_GetStackTrace

Project: https://github.com/cmeister2/libssh2.git https://github.com/libssh2/libssh2.git Detailed Report: https://oss-fuzz.com/testcase?key=5104008459583488 Project: libssh2 Fuzzing Engine: libFuzzer Fuzz Target: ssh2clientfuzzer Job Type: libfuzzerubsanlibssh2 Platform Id: linux Crash Type:...

PT-2025-8364

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.18.0-rc5-arm64-renesas-00116-g73636105874d-dirty 166 Description A vulnerability has been resolved in the Linux kernel. The issue is related to the gpio-keys module, which can either accept gpios or interrupts...

PT-2025-8555

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue occurs in the Linux kernel when the verdict is NF STOLEN, potentially allowing access to freed memory. This happens when tracing is enabled and can involve accessi...

PT-2025-8547 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved. The issue is related to the nvme component, where a change has been made to use a struct group for generic command dwords. This...

PT-2025-8470

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the lpfc driver when CMF is enabled. The issue was observed during I/O operations and resulted in a call trace. The...

PT-2025-8475

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A hard lockup issue in the Linux kernel has been identified, specifically in the lpfc driver. The problem occurs when attempting to log a message with LOG TRACE EVENT, resulting in a...

Wireshark 3.6.x < 3.6.1 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 3.6.1. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-3.6.1 advisory. - Large loop in the Kafka dissector in Wireshark 3.6.0 allows denial of service via packet injection or crafted...

Debian DLA-2843-1 : linux - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2843 advisory. - Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccpshctxccid object as a listene...

Lua through 5.4.0 has a segmentation fault in changedline in ldebug.c (e.g. when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the flow of control to a function.

...

CVE-2021-41090

Grafana Agent prior to versions 0.20.1 and 0.21.2 exposed inline secrets in plaintext via endpoints ./-/config and /agent/api/v1/configs/:key, enabling potential information disclosure if the endpoint is reachable without HTTPS client auth. The issue affects metrics/secret configurations used for...

IBM MQ Appliance Information Disclosure Vulnerability (CNVD-2021-92962)

IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM U.S.A. The IBM MQ Appliance is vulnerable to an information disclosure vulnerability that could be exploited by a local attacker to obtain sensitive information by including sensitiv...

CVE-2021-38999

IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace...

CVE-2021-38999

IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace...

Information disclosure

IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace...

CVE-2021-38999

IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace...

PT-2021-22352

Name of the Vulnerable Software and Affected Versions IBM MQ Appliance affected versions not specified Description The issue allows a local attacker to obtain sensitive information due to the inclusion of sensitive data within a trace. Recommendations At the moment, there is no information about ...

CVE-2021-38999: Exposure of Sensitive Information to an Unauthorized Actor

IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace...

IBM MQ Appliance信息泄露漏洞

IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM U.S.A. The IBM MQ Appliance is vulnerable to an information disclosure vulnerability that could be exploited by a local attacker to obtain sensitive information by including sensitiv...