Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the improper handling of concurrently active streams per connection. An attacker can cause resource exhaustion and disrupt service availability by rapidly sending crafted...

Netty affected by MadeYouReset HTTP/2 DDoS vulnerability

Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which we refer to as “MadeYouReset.” MadeYouReset Vulnerability Summary The MadeYouReset DDoS vulnerability is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to brea...

CVE-2025-53152

Use after free in Desktop Windows Manager allows an authorized attacker to execute code locally...

CVE-2025-53152

Use after free in Desktop Windows Manager allows an authorized attacker to execute code locally...

CVE-2025-50153

Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally...

CVE-2025-50153

Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally...

CVE-2025-53152 Desktop Windows Manager Remote Code Execution Vulnerability

...

CVE-2025-50153

Technical details about CVE-2025-50153 (affected components, root cause, impact specifics, and fixes) are not provided in the connected documents. Monitor for updates from MSRC/NVD for technical disclosure.

CVE-2025-50153 Desktop Window Manager Elevation of Privilege Vulnerability

...

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Updated to version 2.48.5: - CVE-2025-31273: Fixed a vulnerability where processing maliciously crafted web content could lead to memory corruption. bsc1247564 - CVE-2025-31278: Fixed a vulnerability where processing maliciously crafted web...

SUSE-SU-2025:02765-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Updated to version 2.48.5: - CVE-2025-31273: Fixed a vulnerability where processing maliciously crafted web content could lead to memory corruption. bsc1247564 - CVE-2025-31278: Fixed a vulnerability where processing maliciously crafted web...

Desktop Window Manager Elevation of Privilege Vulnerability

Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally...

Desktop Windows Manager Remote Code Execution Vulnerability

Use after free in Desktop Windows Manager allows an authorized attacker to execute code locally...

HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit

Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with target="blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab. Details While most modern...

Use of Web Link to Untrusted Target with window.opener Access

Overview hfs is a HTTP File Server Affected versions of this package are vulnerable to Use of Web Link to Untrusted Target with window.opener Access via the openFileMenu function in the fileMenu.ts file. An attacker can manipulate the content of the original browser tab by exploiting the...

GHSA-XCXH-6CV4-Q8P8 HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit

Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with target="blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab. Details While most modern...

Microsoft Desktop Windows Manager 资源管理错误漏洞

Microsoft Desktop Windows Manager is a desktop window manager from Microsoft Corporation USA. A resource management error vulnerability exists in Microsoft Desktop Windows Manager. An attacker exploiting this vulnerability could execute code. The following products and editions are affected:Windo...

PT-2025-34325 · Npm · Hfs

Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with target=" blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab. Details While most modern...

Linux Distros Unpatched Vulnerability : CVE-2021-38497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Through use of reportValidity and window.open, a plain-text validation message could have been overlaid on another origin, leading to possible user confusion an...

Linux Distros Unpatched Vulnerability : CVE-2022-45404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Through a series of popup and window.print calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in...