CVE-2025-0624

A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grubstrcpy function. During this step, it fails to consider the environment variable length...

AZL-56997 CVE-2025-0624 affecting package grub2 for versions less than 2.06-14

A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grubstrcpy function. During this step, it fails to consider the environment variable length...

DEBIAN-CVE-2025-0624

A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grubstrcpy function. During this step, it fails to consider the environment variable length...

UBUNTU-CVE-2025-0624

A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grubstrcpy function. During this step, it fails to consider the environment variable length...

Cordaware BestInformed security vulnerabilities

Cordaware bestinformed is a mass notification system from Cordaware, Germany. A security vulnerability exists in Cordaware bestinformed that stems from a script variable execution issue that allows an authenticated user to remotely execute code...

GNU GRUB buffer error vulnerability

GRUB2 is a multiple bootloader for the GNU Project. GNU GRUB2 suffers from a buffer overflow vulnerability that stems from a failure to properly account for the length of an environment variable when copying user-controlled environment variable data to an internal buffer, resulting in an...

CVE-2024-12651

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...

SUSE CVE-2024-12798

ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program...

PT-2025-6525

Name of the Vulnerable Software and Affected Versions HGS Mobile App versions prior to 6.5.0 Description The issue is related to an Exposed Dangerous Method or Function vulnerability in the HGS Mobile App, which allows manipulating user-controlled variables. Recommendations For versions prior to...

PT-2025-23640

Name of the Vulnerable Software and Affected Versions Jupyter Core versions prior to 5.8.0 Description The issue affects Jupyter Core on Windows, where the shared %PROGRAMDATA% directory is searched for configuration files, potentially allowing users to create files that impact other users. This ...

UBUNTU-CVE-2024-29214

Improper input validation in UEFI firmware CseVariableStorageSmm for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access...

PT-2025-7163

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: A missing authorization issue in the maxprofile/users/routes.lua file, specifically in the "users endpoint", allows an authenticated attacker with low privileges to enumerate users by...

macOS NVRAM Variable Handler File Read/Write

The vulnerability of the NVRAM Variable Handler component in MacOS systems is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows an attacker to read and write arbitrary files...

NVRAM Variable Handler Unauthenticated Access

The vulnerability of the NVRAM Variable Handler component in MacOS systems is related to access control deficiencies. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: renaming cpunumber1 to dummycpunumber. The per-process variable cpunumber1 is passed as an argument to xlnxeventhandler along with devid, but it is not used in this function. Therefore, the initialization of this...

Azure Linux 3.0 Security Update: less (CVE-2024-32487)

The version of less installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-32487 advisory. - less through 653 allows OS command execution via a newline character in the name of a file, because quoting is...

PT-2025-6072 · Unknown · Phpgurukul Small Crm

Name of the Vulnerable Software and Affected Versions: PHPGurukul Small CRM version 3.0 Description: The issue is related to Cross Site Scripting XSS via a crafted payload injected into the name in the profile.php. This allows for potential malicious script execution. Recommendations: For...

BIT-GOLANG-2025-22866 Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private...

CVE-2025-22866

A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leaka...

PT-2025-16544 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version V4.0si V16.03.10.20 Description: The issue concerns a buffer overflow in the AdvSetMacMtuWan function through the serverName2 variable. This can potentially allow for unauthorized access or control. Recommendations: For Ten...