14025 matches found
CVE-2025-37816 mei: vsc: Fix fortify-panic caused by invalid counted_by() use
In the Linux kernel, the following vulnerability has been resolved: mei: vsc: Fix fortify-panic caused by invalid countedby use gcc 15 honors the countedbylen attribute on vsctppacket.buf and the vsc-tp.c code is using this in a wrong way. len does not contain the available size in the buffer, it...
CVE-2025-41399
When a Stream Control Transmission Protocol SCTP profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2025-36504
When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2025-41399 SCTP Vulnerability
When a Stream Control Transmission Protocol SCTP profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
Security update for libsoup2
This update for libsoup2 fixes the following issues: CVE-2025-2784: Fixed heap buffer over-read in skipinsignificantspace when sniffing conten bsc1240750 CVE-2025-32050: Fixed integer overflow in appendparamquoted bsc1240752 CVE-2025-32052: Fixed heap buffer overflow in sniffunknown bsc1240756...
python-werkzeug: user may execute code on a developer's machine
A flaw was found in Werkzeug, where an attacker may be able to execute code on a developer's machine under some circumstances. This issue requires the attacker to get the developer to interact with a domain and subdomain they control and enter the debugger PIN; if they are successful, it allows...
python-werkzeug: high resource usage when parsing multipart form data with many fields
A flaw was found in python-werkzeug. Werkzeug is multipart form data parser, that will parse an unlimited number of parts, including file parts. These parts can be a small amount of bytes, but each requires CPU time to parse, and may use more memory as Python data. If a request can be made to an...
Regular Expression Denial Of Service (ReDoS)
Transformers is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression processing due to a regex with exponential time complexity in the SubWordJapaneseTokenizer class, leading to excessive backtracking and high CPU usage...
Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver
Info ░█▄█░█▀█░█░█░█░█░█░█░▀█▀░█▀█░█▀█░█▀▄░█░█ ░█░█░█▀▀░█░█░...
Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver
Info ░█▄█░█▀█░█░█░█░█░█░█░▀█▀░█▀█░█▀█░█▀▄░█░█ ░█░█░█▀▀░█░█░...
PT-2025-20302 · F5 · Big-Ip
Name of the Vulnerable Software and Affected Versions: BIG-IP affected versions not specified Description: The issue occurs when a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, and undisclosed responses can cause an increase in memory resource utilization. Recommendations: A...
F5 BIG-IP 安全漏洞
F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing from F5 USA. A security vulnerability exists in F5 BIG-IP that stems from increased memory resource utilization...
Disable the Root User from Logging in to the System Using SSH
The PermitRootLogin parameter in the SSH configuration file /etc/ssh/sshdconfig specifies whether the root user can log in to the system using SSH. The root user is not allowed to log in to the system using SSH. System administrators must use their own user to log in to the system using SSH and r...
F5 BIG-IP 安全漏洞
F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing from F5 USA. A security vulnerability exists in F5 BIG-IP that stems from an SCTP configuration that results in increased memory resource utilization...
Do Not Use auditctl to Set auditd Rules
auditd service rules can be configured using either rule files in the /etc/audit/rules.d/ directory applied after server restart or the auditctl command for immediate effect. The permission of the /etc/audit/rules.d/ directory is 750, while that of the auditctl command is 755. Therefore,...
Ensure That Partitions That Do Not Need to Be Mounted with Devices Are Mounted Using nodev
The nodev option specifies that the file system cannot contain device files. It is used to reduce the attack surface and improve security. If a directory is mounted with the nodev option, all device files, such as files of block devices and character devices in the directory, are parsed as common...
Enable the haveged Service
The haveged service can generate an unpredictable stream of random numbers in a simple way. These random numbers can fill the system entropy pool, which can solve the problem of low system entropy in some cases. You are advised to enable this service to meet the needs of encryption, decryption, o...
Do Not Enable the LDAP Service
Lightweight Directory Access Protocol LDAP is a protocol that provides access control and is used to maintain distributed directory information. The LDAP service increases system resource usage and expands the attack surface. If the LDAP service is not required, do not install the LDAP service. T...
golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
A flaw was found in the golang-jwt implementation of JSON Web Tokens JWT. In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an...