DHCP: DHCP routing options can manipulate interface-based VPN traffic

DHCP can add routes to a client’s routing table via the classless static route option 121. VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify...

GHSA-F372-9RCJ-8W2C Liferay Portal and DXP allows users to add a note to a different virtual instance

Insecure Direct Object Reference IDOR vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a...

ALSA-2025:16428 Moderate: libtpms security update

The libtpms is a library providing Trusted Platform Module TPM functionality for virtual machines. Security Fixes: libtpms: Libtpms Out-of-Bounds Read Vulnerability CVE-2025-49133 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

RHEL 9 : NetworkManager (RHSA-2025:16411)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:16411 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...

CVE-2025-43810

Insecure Direct Object Reference IDOR vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a...

CVE-2025-43810

Insecure Direct Object Reference IDOR vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a...

CVE-2025-43810

CVE-2025-43810 affects Liferay Portal and Liferay DXP, where an insecure direct object reference via the parameter _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId allows a remote authenticated user to add a note to an order in a different virtual instance. Af...

CVE-2025-9035

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform allows Reflected XSS. This issue affects Virtual Library Platform: before v202...

CVE-2025-9035

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform allows Reflected XSS. This issue affects Virtual Library Platform: before v202...

CVE-2025-9035 Reflected XSS in Horato Internet Technologies' Virtual Library Platform

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform allows Reflected XSS. This issue affects Virtual Library Platform: before v202...

CVE-2025-9035 Reflected XSS in Horato Internet Technologies' Virtual Library Platform

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform allows Reflected XSS. This issue affects Virtual Library Platform: before v202...

CVE-2025-9035

The CVE-2025-9035 issue affects Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform. Multiple connected sources confirm a vulnerability in input handling during web page generation that enables Reflected Cross-Site Scripting (XSS) in versions older than a released fixed vers...

Sensitive Information Disclosure

Liferay Portal is vulnerable to Sensitive Information Disclosure.The vulnerability is due to improper tenant isolation because admin users of a virtual instance can add pages outside the default instance, allowing tenants to enumerate all other tenants...

nightmare

This repository is an introduction to binary exploitation and reverse engineering course based on CTF challenges, called "Nightmare". It contains a large amount of content, with over 90 challenges, laid out in a linear fashion, and well-documented write-ups explaining how to go from being handed...

Release Information for Veeam Plug-in for Proxmox VE v12.1.5.17

Requirements This update to the Veeam Plug-in for Proxmox VE requires: Veeam Backup & Replication build 12.3.2.3617 You can check the build number in the Veeam Backup & Replication Console's Main Menu ≡ under Help About. Veeam Plug-in for Proxmox VE build 12.1.3.217 You can check the current buil...

PT-2025-38703

Name of the Vulnerable Software and Affected Versions Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform versions prior to 20.0 Description The software contains a flaw related to improper input handling during web page generation, potentially leading to Reflected Cross-sit...

PT-2025-39087

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.5 through 7.4.3.112 Liferay DXP versions 2023.Q4.0 through 2023.Q4.8 Liferay DXP versions 2023.Q3.1 through 2023.Q3.10 Liferay versions 7.4 GA through update 92 Description An Insecure Direct Object Reference IDOR...

Unbreakable Enterprise kernel security update

5.15.0-312.187.5.3 - HID: core: do not bypass hidhwrawrequest Benjamin Tissoires Orabug: 38454666 CVE-2025-38494 - vsock: Do not allow binding to VMADDRPORTANY Budimir Markovic Orabug: 38454665 CVE-2025-38618 - cloneprivatemnt: make sure that caller has CAPSYSADMIN in the right userns Al Viro...

CVE-2025-43808

The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which...

CVE-2025-34201

Vasion Print formerly PrinterLogic Virtual Appliance Host and Application VA and SaaS deployments run many Docker containers on shared internal networks without firewalling or segmentation between instances. A compromise of any single container allows direct access to internal services HTTP, Redi...