Vulnerabilities

Improper neutralization of input during web page generation (&amp;#39;cross-site scripting&amp;#39;) vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS.<br /> <br /> This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319.

Improper neutralization of input during web page generation (&amp;#39;cross-site scripting&amp;#39;) vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS.<br /> <br /> This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319.

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file&amp;#39;s ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINI_CLI_HOME to load malicious configuration files and bypass folder trust prompts.

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session.<br /> <br /> <br /> <br /> This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.<br /> <br /> <br /> <br /> Users are recommended to upgrade to version 2.57.0, which fixes the issue.

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &amp;#39;sbm_description&amp;#39; parameter in all versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product.

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed.

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS&amp;#39;s scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

A flaw was found in SSSD&amp;#39;s IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user&amp;#39;s identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user&amp;#39;s identifier can authenticate as the target user.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vlan: fix skb_under_panic and races when toggling HW VLAN offload<br /> <br /> Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or<br /> NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),<br /> which dynamically changed vlandev-&gt;hard_header_len.<br /> <br /> This causes two issues:<br /> 1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)<br /> read dev-&gt;hard_header_len without holding RTNL lock. Mutating<br /> hard_header_len dynamically under RTNL creates a data race where upper<br /> layers reserve insufficient headroom based on a stale hard_header_len,<br /> resulting in skb_under_panic when vlan_dev_hard_header() is called.<br /> 2. In addition, vlan_transfer_features() updated hard_header_len without<br /> updating header_ops, causing a mismatch between allocated headroom<br /> and header creation.<br /> <br /> Always setting dev-&gt;hard_header_len = real_dev-&gt;hard_header_len and<br /> dev-&gt;needed_headroom = real_dev-&gt;needed_headroom + VLAN_HLEN unconditionally<br /> ensures:<br /> - dev-&gt;hard_header_len remains 100% static and immutable at real_dev-&gt;hard_header_len,<br /> eliminating all dynamic runtime updates and data races on hard_header_len.<br /> - Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve<br /> sufficient headroom for software VLAN tag insertion (real_dev-&gt;hard_header_len +<br /> real_dev-&gt;needed_headroom + VLAN_HLEN).<br /> - vlandev inherits real_dev-&gt;needed_tailroom so underlying trailer/padding/ICV<br /> requirements are honored.<br /> - AF_PACKET SOCK_RAW network header offsets remain correctly aligned at<br /> real_dev-&gt;hard_header_len.<br /> - vlan_header_ops is used unconditionally.<br /> <br /> Note to stable teams: Make sure to backport these commits:<br /> <br /> e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev")<br /> cef51860becd ("macvlan: inherit needed_headroom and needed_tailroom from lowerdev")