CVE-2025-38197

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dellrbu: Fix list usage Pass the correct list head to listforeachentry when looping through the packet list. Without this patch, reading the packet data via sysfs will show the data incorrectly because it starts at...

Pentest-and-Development-Tips

Pentest-and-Development-Tips A collection of pentest and development tips Author: 3gstudent Click on me to view the English version 声明 以下技巧不应用于非法用途 --- Tips 1. 手动端口探测 nmap的-sV可以探测出服务版本，但有些情况下必须手动探测去验证 使用Wireshark获取响应包未免大材小用，可通过nc简单判断 eg. 对于8001端口，nc连接上去，随便输入一个字符串，得到了以下结果： $ nc -vv localhost 8001...

SUSE CVE-2025-38179

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix maxsge overflow in smbextractfolioqtordma This fixes the following problem: 749.901015 T8673 run fstests cifs/001 at 2025-06-17 09:40:30 750.346409 T9870...

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Sudo_Project Sudo

CVE-2025-32463: Local Privilege Escalation Exploit for Sudo !...

CVE-2025-38197 platform/x86: dell_rbu: Fix list usage

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dellrbu: Fix list usage Pass the correct list head to listforeachentry when looping through the packet list. Without this patch, reading the packet data via sysfs will show the data incorrectly because it starts at...

SUSE-SU-2025:20465-1 Security update for gpg2

This update for gpg2 fixes the following issues: - gpg: Allow the use of an ADSK subkey as ADSK subkey. bsc1239119 CVE-2025-30258 - Don't install expired sks certificate bsc1243069...

[SECURITY] [DSA 5958-1] jpeg-xl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5958-1 [email protected] https://www.debian.org/security/ Aron Xu July 04, 2025 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

Debian dsa-5958 : jpeg-xl-doc - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5958 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5958-1 [email protected] https://www.debian.org/securit...

ROS-20250703-07

A vulnerability in the DevTools component of the Google Chrome browser is related to insufficient input validation. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service A vulnerability in the libvpx library of the Google Chrome and Microsoft Edge...

CVE-2025-38092

CVE-2025-38092 affects the ksmbd component in the Linux kernel. Root cause: the list_first_entry() macro can yield an invalid pointer on empty lists; replaced with list_first_entry_or_null() to safely handle empty lists. Impact described in connected sources includes potential service failure and...

PDFs: Portable documents, or perfect deliveries for phish?

Cisco recently developed and released an update to its brand impersonation detection engine for emails. This new update enhances detection coverage and includes a wider range of brands that are delivered using PDF payloads or attachments. A significant portion of email threats with PDF payloads...

Exploit for Improper Check for Unusual or Exceptional Conditions in Mozilla Firefox

CVE-2024-4367 POC for PDF.js POC for PDF.js' CVE-2024-4367 vu...

JetBrains TeamCity diskUsageBuildsStats Page Cross Site Scripting Vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. JetBrains TeamCity suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data on the...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the process handling HTTP header fields. An attacker can cause excessive memory consumption and potentially crash or render the server unresponsive by sending a large number of HTTP headers. Details Denial of...

python-werkzeug: high resource usage when parsing multipart form data with many fields

A flaw was found in python-werkzeug. Werkzeug is multipart form data parser, that will parse an unlimited number of parts, including file parts. These parts can be a small amount of bytes, but each requires CPU time to parse, and may use more memory as Python data. If a request can be made to an...

CLSA-2025-1750879249 Update of tzdata

Upgrade to tzdata-2025b - New zone for Aysén Region in Chile which moves from -04/-03 to -03. - Paraguay adopted permanent -03 starting spring 2024. - Improve pre-1991 data for the Philippines. - Etc/Unknown is now reserved. - Improve historical data for Mexico, Mongolia, and Portugal. - System V...

Exploit for CVE-2025-49132

CVE-2025-49132 Standalone Vulnerability Scanner Non-Docker...

CVE-2025-52937

Vulnerability in PointCloudLibrary PCL surface/src/3rdparty/opennurbs modules. This vulnerability is associated with program files crc32.C. This vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib WITHSYSTEMZLIB=FALSE...

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service...

Regular Expression Denial Of Service (ReDoS)

com.powsybl, powsybl-commons is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regex handling causing excessive backtracking, which allows an attacker to trigger high CPU usage and potentially crash or slow down the system...