Use of Web Link to Untrusted Target with window.opener Access

Overview hfs is a HTTP File Server Affected versions of this package are vulnerable to Use of Web Link to Untrusted Target with window.opener Access via the openFileMenu function in the fileMenu.ts file. An attacker can manipulate the content of the original browser tab by exploiting the...

GHSA-XCXH-6CV4-Q8P8 HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit

Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with target="blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab. Details While most modern...

PT-2025-34325 · Npm · Hfs

Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with target=" blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab. Details While most modern...

Microsoft Desktop Windows Manager 资源管理错误漏洞

Microsoft Desktop Windows Manager is a desktop window manager from Microsoft Corporation USA. A resource management error vulnerability exists in Microsoft Desktop Windows Manager. An attacker exploiting this vulnerability could execute code. The following products and editions are affected:Windo...

Linux Distros Unpatched Vulnerability : CVE-2021-38497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Through use of reportValidity and window.open, a plain-text validation message could have been overlaid on another origin, leading to possible user confusion an...

Linux Distros Unpatched Vulnerability : CVE-2022-45404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Through a series of popup and window.print calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in...

Linux Distros Unpatched Vulnerability : CVE-2022-50177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: rcutorture: Fix ksoftirqd boosting timing and iteration The RCU priority boosting can fail i...

Medium: libarchive

Issue Overview: A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber LZSS window. This means the library may attempt to read beyond the allocated memory...

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

...

Linux Distros Unpatched Vulnerability : CVE-2020-15664

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - By holding a reference to the eval function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would...

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: out-of-bounds read in x rendering extension animated cursors

...

CVE-2025-54804

Russh is a Rust SSH client/server library. In versions ≤0.54.0, CHANNEL_WINDOW_ADJUST handling computes recipient_window_size from the decoded value without proper overflow checks, causing an integer overflow that can crash the server. The issue is fixed in version 0.54.1. Attacker impact is serv...

CVE-2025-54804

Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an...

CVE-2025-54804 Russh is missing an overflow check during channel windows adjust

Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an...

russh is missing overflow checks during channel windows adjust

Summary The channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rus...

GHSA-H5RC-J5F5-3GCM russh is missing overflow checks during channel windows adjust

Summary The channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rus...

xorg-x11-server: heap buffer overflow in DisableDevice

A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments...

xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability

A vulnerability was found in X.Org Server. This flaw occurs if a client explicitly destroys the compositor overlay window aka COW, where Xserver leaves a dangling pointer to that window in the CompScreen structure, which will later trigger a use-after-free issue. The Overlay Window use-after-free...

StarDict 安全漏洞

StarDict is a desktop dictionary software from StarDict open source. A security vulnerability exists in StarDict version 3.0.7+git20220909+dfsg-6, which stems from the YouDao plugin sending X11 selections to a remote server via plaintext HTTP...

PT-2025-31887 · Russh · Russh

Name of the Vulnerable Software and Affected Versions: Russh versions 0.54.0 and earlier Description: Russh is a Rust SSH client & server library. The implementation of the SSH protocol's channel window adjust message does not properly validate the incoming value, leading to a potential integer...