Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to CVE-2025-22150 in undici-6.20.1

Summary undici-6.20.1 is used by IBM Storage Fusion Data Foundation in management-console. This bulletin identifies the steps to take to address the vulnerability CVE-2025-22150 in IBM Storage Fusion Data Foundation. Vulnerability Details CVEID:CVE-2025-22150 DESCRIPTION: Undici is an HTTP/1.1...

PT-2025-26751

Name of the Vulnerable Software and Affected Versions: Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. Wi-Fi Cloud Hotspot versions prior to 30.05.2025 Description: The issue affects Wi-Fi Cloud Hotspot due to an improper restriction of excessive authentication attempts, allowing...

CVE-2025-50348

PHPGurukul Pre-School Enrollment System Project V1.0 is vulnerable to Directory Traversal in update-class-pic.php...

CVE-2025-6545

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2...

CVE-2025-6516

A vulnerability has been found in HDF5 up to 1.14.6 and classified as critical. This vulnerability affects the function H5Faddrdecodelen of the file /hdf5/src/H5Fint.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to...

PT-2025-26573 · Unknown · Spytrap-Adb

Name of the Vulnerable Software and Affected Versions: spytrap-adb versions prior to 0.3.5 Description: The issue causes matches for known stalkerware to not be rendered or displayed in the interactive user interface. This potentially allows dangerous spyware infections to go unnoticed by users...

PT-2025-26374 · WordPress · Matt Wp Voting Contest

Name of the Vulnerable Software and Affected Versions: Matt WP Voting Contest versions n/a through 5.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-26349 · Unknown · User Roles/Capabilities

Name of the Vulnerable Software and Affected Versions: mahabub81 User Roles and Capabilities versions 1.2.6 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For...

CVE-2022-50115

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-topology: Prevent double freeing of ipccontroldata via loadbytes We have sanity checks for byte controls and if any of the fail the locally allocated scontrol-ipccontroldata is freed up, but not set to NULL. On a...

CVE-2022-50013

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use f2fsbugon in f2fsnewnodepage As Dipanjan Das reported, syzkaller found a f2fs bug as below: RIP: 0010:f2fsnewnodepage+0x19ac/0x1fc0 fs/f2fs/node.c:1295 Call Trace: writeallxattrs fs/f2fs/xattr.c:487 inline...

CVE-2022-50033

In the Linux kernel, the following vulnerability has been resolved: usb: host: ohci-ppc-of: Fix refcount leak bug In ohcihcdppcofprobe, offindcompatiblenode will return a node pointer with refcount incremented. We should use ofnodeput when it is not used anymore...

CVE-2022-50016

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FWREADY message it is not yet clear if FWREADY...

CVE-2022-50190

In the Linux kernel, the following vulnerability has been resolved: spi: Fix simplification of devmspiregistercontroller This reverts commit 59ebbe40fb51 "spi: simplify devmspiregistercontroller". If devmaddaction fails in devmaddactionorreset, devmspiunregister will be called, it decreases the...

CVE-2022-50147

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix getnodes out of bound access When user specified more nodes than supported, getnodes will access nmask array out of bounds...

CVE-2022-50039

In the Linux kernel, the following vulnerability has been resolved: stmmac: intel: Add a missing clkdisableunprepare call in intelethpciremove Commit 09f012e64e4b "stmmac: intel: Fix clock handling on error and remove paths" removed this clkdisableunprepare This was partly revert by commit...

CVE-2022-50166

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: When HCI work queue is drained, only queue chained work The HCI command, event, and data packet processing workqueue is drained to avoid deadlock in commit 76727c02c1e1 "Bluetooth: Call drainworkqueue before resetting...

CVE-2022-50177

In the Linux kernel, the following vulnerability has been resolved: rcutorture: Fix ksoftirqd boosting timing and iteration The RCU priority boosting can fail in two situations: 1 If nrcpus= maxcpus=, which means if the total number of CPUs is higher than those brought online at boot, then...

CVE-2022-50142

In the Linux kernel, the following vulnerability has been resolved: intelth: msu: Fix vmalloced buffers After commit f5ff79fddf0e "dma-mapping: remove CONFIGDMAREMAP" there's a chance of DMA buffer getting allocated via vmalloc, which messes up the mmapping code: RIP: mscmmapfault intelthmsu Call...

CVE-2022-50098

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts Ensure SRB is returned during I/O timeout error escalation. If that is not possible fail the escalation path. Following crash stack was seen: BUG: unable to...

CVE-2022-50220

In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix linkwatch use-after-free on disconnect usbnet uses the work usbnetdeferredkevent to perform tasks which may sleep. On disconnect, completion of the work was originally awaited in -ndostop. But in 2003, that was moved ...