CVE-2025-8699

Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards. Attackers could potentially use this vulnerability to change the balance on the cards and generate money. The account balance is stored on an insecure MiFare Classic NFC card and can be read and written back. By...

CVE-2025-8699

CVE-2025-8699 affects KioSoft’s Stored Value Unattended Payment Solutions. The flaw centers on insecure MiFare Classic NFC cards storing account balances that can be read and written, enabling an attacker to identify value fields and a checksum (calculated by XOR-ing cash with an unknown field) a...

CVE-2025-8699

Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards. Attackers could potentially use this vulnerability to change the balance on the cards and generate money. The account balance is stored on an insecure MiFare Classic NFC card and can be read and written back. By...

Signature Malleability

github.com/consensys/gnark is vulnerable to signature malleability. The vulnerability is due to improper validation of the S value in EdDSA and ECDSA signatures not enforcing 0 ≤ S order, which allows an attacker to create multiple valid signatures for the same public input, potentially enabling...

KioSoft Stored Value Unattended Payment Solutions 安全漏洞

KioSoft Stored Value Unattended Payment Solutions is a self-service payment solution from KioSoft USA. A security vulnerability exists in KioSoft Stored Value Unattended Payment Solutions that stems from the use of an insecure MiFare Classic NFC card to store account balances, which could allow a...

GHSA-QHJ8-Q5R6-8Q6J matrix-sdk-base: Panic in the `RoomMember::normalized_power_level()` method

In matrix-sdk-base before 0.14.1, calling the RoomMember::normalizedpowerlevel method can cause a panic if a room member has a power level of Int::Min. Patches The issue is fixed in matrix-sdk-base 0.14.1. Workarounds The affected method isn’t used internally, so avoiding calling...

PT-2025-44119

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to vringh handling. The issue involves an incorrect check of return values from the copy from iter and copy to iter functions, potentially leadi...

Linux Distros Unpatched Vulnerability : CVE-2022-22892

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is an Assertion 'ecmaisvalueundefined value || ecmaisvaluenull value || ecmaisvalueboolean value || ecmaisvaluenumber value || ecmaisvaluestring value ||...

Linux Distros Unpatched Vulnerability : CVE-2021-46350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is an Assertion 'ecmaisvalueobject value' failed at jerryscript/jerry-core/ecma/base/ecma- helpers-value.c in JerryScript 3.0.0. CVE-2021-46350 Note that...

Linux Distros Unpatched Vulnerability : CVE-2018-16809

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and...

CVE-2025-7491

creationtimestamp| type| source ---|---|--- 2025-09-09 20:51:39+00:00| seen| MISP/e0a0042d-e47b-4875-b781-99d4428af3c2...

CVE-2025-34174

The CVE affects pfSense CE in the Status Traffic Totals feature: /usr/local/www/status_traffic_totals.php processes the start-day parameter. The parameter is not validated as numeric nor sanitized for HTML, allowing the value to be saved as the default display for all users, which triggers stored...

GHSA-93MF-426M-G6X9 CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion

Summary The CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling cache pinning for very long periods. This can effectively cause a denial of service for DNS updates/changes to affected services. Details In plugin/etcd/etcd.go, the...

CVE-2025-55146

An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 Fix deployed on 02-Aug-2025 allows a remote authenticated attacker with admin privileges t...

CVE-2025-55146

Summary: CVE-2025-55146 describes an unchecked return value in Ivanti Connect Secure (before 22.7R2.9) and Ivanti Policy Secure (before 22.7R1.6), Ivanti ZTA Gateway (before 2.8R2.3-723), and Ivanti Neurons for Secure Access (before 22.8R1.4) that enables a remote authenticated attacker with admi...

PT-2025-36749

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.9 Ivanti Connect Secure versions prior to 22.8R2 Ivanti Policy Secure versions prior to 22.7R1.6 Ivanti ZTA Gateway versions prior to 2.8R2.3-723 Ivanti Neurons for Secure Access versions prior t...

SUSE CVE-2025-39685

In the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number0x80008000 that was too large, which triggered the oob. Added an interrupt number check to prevent users from passing in an irq number that was too...

UBUNTU-CVE-2019-25225

sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting XSS. The sanitizeHtml function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed...

Google Android Information Disclosure Vulnerability (CNVD-2025-23028)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability caused by an insecure default value flaw in the generateRandomPasword function in LocalBluetoothLeBroadcast.java. An attacker can exploit the leak to obtai...

PT-2025-36492

Name of the Vulnerable Software and Affected Versions: KioSoft "Stored Value" Unattended Payment Solutions affected versions not specified Description: KioSoft "Stored Value" Unattended Payment Solutions utilize vulnerable NFC cards. An attacker could potentially modify the balance on these cards...